xxx.xxx.xxx.112 68.168.113.155 SSH [TCP Retransmission] Encrypted
response packet len=35
68.168.113.155 xxx.xxx.xxx.112 TCP [TCP Previous segment lost] 33514 >
ssh [ACK] Seq=21 Ack=36 Win=5888 Len=0 TSV=3950744190 TSER=4316095
SLE=1 SRE=36
68.168.113.155 xxx.xxx.xxx.112 SSHv2 [TCP Retransmission] Client
Protocol: SSH-2.0-libssh-0.1\r
Haver you got SSH configured on the host computer to port forward to the servers (Are the virtual hosts in bridged or NAT mode?) - Looks to be bridged.
I would have thought that this could just be someone 'trying' to brute force SSH. It doesn't necessarily mean they have been able to successfully connect from the logs above unless I am missing something.
Have a scroll through you logs for successful/unsuccessful attempts on SSH.
--
Shaineel Singh
e:
shain.singh@xxxxxxxxx
p: +61 422 921 951
w:
http://buffet.shainsingh.com--
"Too many have dispensed with generosity to practice charity" - Albert Camus
