tcp 22 > tcp 22

[Tarmo Renter]

Hi,

I spotted today following line at my FreeBSD 4.6.2-RELEASE IPFIREWALL log:

Jul  1 13:34:35 fbsd /kernel: ipfw: 1400 Accept TCP xxxxxx:22 yyyyy:22 in via 
ed1

where xxxxxx is the attacker's IP and yyyyy is my box.

But in sshd log, there are no traces left behind by this connection.
Normally, there is "Did not receive identification string from xxx" etc, when 
somebody tries to scan SSH port.

Also, as you can see, the connection is made from port 22 to port 22, which is 
odd.

Is this somekind of SYN packet trick and how come is no I/O to sshd made?

sshd -v shows:
sshd version OpenSSH_3.4p1 FreeBSD-20020702
---
Regards,
Tarmo Renter