I tried to check who is connecting to my server and got this line I could not recognized. I used sudo lsof -i -n | egrep '\<ssh\>'.

And these lines looks odd to me: sshd 5921 sshd 3u IPv4 66008 0t0 TCP> 605 (ESTABLISHED) sshd 5922 root 3u IPv4 66056 0t0 TCP> 008 (ESTABLISHED) sshd 5923 sshd 3u IPv4 66056 0t0 TCP> 008 (ESTABLISHED) sshd 5924 root 3u IPv4 66082 0t0 TCP> 407 (ESTABLISHED)

The address is from HongKong and I am not aware of why that could happen.

  • 1
    might be interesting to check ps on those PIDs and their parent PIDs to check which processes started these connections. – Bram Nov 22 '15 at 10:08

Established TCP connection is probably authentication attempt, which doesn't mean that the authentication was successful. It is probably just a noise, but of course, you should check the PIDs as proposed in the comment, if the sshd process is in [preauth] mode or [postauth] -- should be visible in normal ps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.