Aruba & ProVision-based
1748073 Members
4747 Online
108758 Solutions
New Discussion

Re: ProCurve Switch - SSH connection

 
Ninja4IT
Occasional Advisor

ProCurve Switch - SSH connection

Hi guys,

 

we have about 10 ProCurve 2520-24-PoE switches.
Today by reading log events (show logging) I found many SSH connection to switch like this :

 

auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session


But nowhere is nothing about source (IP address) where from is comming this attack (I hope not!)

How can I detect this connection? I want to find this source (IP).

 

Thanks for help and best regards.

 

1 REPLY 1
JoanPrilo
Occasional Contributor

Re: ProCurve Switch - SSH connection

Hello,

If you want see the source IP of connections via SSH, try you issue "show logging SSH" command.

With the SSH filter, of all logging cache, must show the lines with "SSH", here must appears the source IP.

I hope I help you.

Regards.