brutal SSH attacks

Wed Feb 9 01:38:20 UTC 2011

On Feb 8, 2011, at 8:36 PM, Helmut Schneider wrote:

>> Here are entries with pass in log enabled:
>> 
>> 19:59:08.149358 rule 5/0(match): pass in on bce1: 93.174.31.134.36872 > 38.X.X.X.22: Flags [S], seq 441726758, win 5840, options [mss 1460,sackOK,TS val 395810874 ecr 0,nop,wscale 7], length 0
> 
> And 38.x.x.x is the external ip of your gateway?! (my last guess for today^Wtonight...) 

yes, it is