Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

sshd[7846]: Bad protocol version identification ' ' from 192.168.0.10

I am constantly getting this message from syslog server?  Any ideas?

Syslog message:
Facility: 4 
Priority: 6 
Source: fw

Message:
sshd[7846]: Bad protocol version identification '  ' from 192.168.0.10


This thread was automatically locked due to age.
Parents Reply Children
  • hi,

    what kind of 'query/monitoring' is it? if the monitoring box does just a telnet to port 22 of the ASL-box and closes without any handshaking, you'll get these syslog entries:

    ex:
    telnet fw 22

    syslog:
    Nov 27 19:19:08 fw sshd[1861]: Bad protocol version identification 'ÿôÿý^F  ' from 192.168.xxx.xxx

    maybe you should optimize your monitoring tool.

    bye,
    michael