Aruba & ProVision-based
cancel
Showing results for 
Search instead for 
Did you mean: 

ProCurve Switch - SSH connection

 
Highlighted
Ninja4IT
Occasional Advisor

ProCurve Switch - SSH connection

Hi guys,

 

we have about 10 ProCurve 2520-24-PoE switches.
Today by reading log events (show logging) I found many SSH connection to switch like this :

 

auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session


But nowhere is nothing about source (IP address) where from is comming this attack (I hope not!)

How can I detect this connection? I want to find this source (IP).

 

Thanks for help and best regards.

 

1 REPLY 1
Highlighted
JoanPrilo
Occasional Contributor

Re: ProCurve Switch - SSH connection

Hello,

If you want see the source IP of connections via SSH, try you issue "show logging SSH" command.

With the SSH filter, of all logging cache, must show the lines with "SSH", here must appears the source IP.

I hope I help you.

Regards.