Security Question

[hzmuda]

I noticed this in my log this morning. Is there anyway I can find the IP address of the person trying to log into my router (1711)?

001315: Feb 21 08:11:48.548 EST: SSH0: password authentication failed for test

001316: Feb 21 08:11:48.548 EST: SSH0: AAA authentication fail reason: Password:

001317: Feb 21 08:11:52.356 EST: SSH0: password authentication failed for guest

001318: Feb 21 08:11:52.356 EST: SSH0: AAA authentication fail reason: Password:

001319: Feb 21 08:11:54.892 EST: SSH0: password authentication failed for admin

001320: Feb 21 08:11:54.892 EST: SSH0: AAA authentication fail reason: Password:

001321: Feb 21 08:11:57.528 EST: SSH0: password authentication failed for admin

001322: Feb 21 08:11:57.532 EST: SSH0: AAA authentication fail reason: Password:

001323: Feb 21 08:12:00.324 EST: SSH0: password authentication failed for user

001324: Feb 21 08:12:00.324 EST: SSH0: AAA authentication fail reason: Password:

001325: Feb 21 08:12:02.953 EST: SSH0: password authentication failed for root

001326: Feb 21 08:12:02.953 EST: SSH0: AAA authentication fail reason: Password:

001327: Feb 21 08:12:05.657 EST: SSH0: password authentication failed for root

001328: Feb 21 08:12:05.661 EST: SSH0: AAA authentication fail reason: Password:

001329: Feb 21 08:12:08.173 EST: SSH0: password authentication failed for root

001330: Feb 21 08:12:08.173 EST: SSH0: AAA authentication fail reason: Password:

001331: Feb 21 08:12:10.733 EST: SSH0: password authentication failed for test

001332: Feb 21 08:12:10.733 EST: SSH0: AAA authentication fail reason: Password:

[smalkeric]

Try the "show users " command in the router.

[will.shaw]

Are you using the ACS server for authentication? If so you shuld be able to look in the 'failed attempt' report and look up the 'caller ID'.