SSH error

badday · ‎12-10-2022

Dear All,

My switch stopped working for some time, I got the below error in log, we are using SSH protocol, and we don't have VLAN200 in our LAN network, any idea? Is it attack or normal IP misconfigure by someone? The only way allowed to SSH this switch is from Core switch only.

Dec 4 00:02:35.095: %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 192.168.200.40

marce1000 · ‎12-10-2022

- What is the switch model ?

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

badday · ‎12-11-2022

It's 2960 cisco switch

Version 15.2(7)E3

marce1000 · ‎12-11-2022

- Similar to this bug https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsu27706 , probably related to resource exhaustion , you may need to reboot the device when a windows for that is available.

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

Georg Pauwen · ‎12-11-2022

Hello,

it (obviously) looks like 192.168.200.40 is trying to SSH into your switch. If that IP address is not in your network, somebody (or some automated program) might be trying to gain access. It could also be a spoofed IP address. Are your users able to configure their own IP addresses, and/or connect random devices to random switchports ? What kind of security do you have configured (e.g. port security, 802.1x authentication) ?