Messages

Great idea Simon, but I think our switches don't support this options with ACL.
I found this document for HP switches, only in version 2530 is ACL supported.

HP Procurve 25XX


Is maybe possible monitorng traffic with Wireshark?

Thanks SimonV, of course we will do reconfiguration. But still, I want to know what is source IP, maybe we have affected computer in our network or maybe (I hope not) attacker.

Maybe other advice for additional network monitoring?

Hi guys,

we have about 10 ProCurve 2520-24-PoE switches.
Today by reading log events (show logging) I found many SSH connection to switch like this :


auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session
auth: Invalid user name/password on SSH session


But nowhere is nothing about source (IP address) where from is comming this attack (I hope not!)

How can I detect this connection? I want to find this source (IP).


Thanks for help and best regards.