[PLUG] SSH log entries need explanation

[Rich Shepard]

On Mon, 12 Aug 2024, Daniel Hückmann wrote:

> Those messages indicate that your SSH server attempted to send an
> identification string (usually the SSH protocol version) to the client
> connecting from the IP address 206.168.34.210 on various ports, but it was
> unable to do so. This failure typically happens if the client closes the
> connection before the string is sent or if there’s a network issue.
>
> Ports 40828, 40844, 46502, and 59586 are ephemeral ports, which are
> typically used by clients during outbound connections. The fact that
> multiple ports were used might suggest a scan or a series of connection
> attempts.
>
> I'd guess a compromised ISP customer, or a curious kiddo scanning the
> Internet.

Thanks for confirming my assumption, Daniel.

Regards,

Rich