"%SSH-4-SSH2_UNEXPECTED_MSG"in Router Logs

[mudasir05]

Hello All,

In my production Router i see this mesg "%SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection from 54.172.12.45".

Everyday i check this mesg in my logs with different IP.

Kindly let me know the possible reasons of its cause and how to avoid this in future.

Thanks

[johnlloyd_13]

hi,

is this an internet edge router?

looks like the IP 54.172.12.45 (a NJ USA IP) is trying a brute force attack.

try to 'harden' your router by limiting the number of SSH login retries and configuring ACL on your VTY lines.

[mudasir05]

Hi John,

yes this is an internet edge router....moreover i happen to see different IPs as well.

sure i will limit the number of ssh login entries and will configure acl as well.

thanks

[mudasir05]

Hi John,

I tried to limit the number of ssh login entries,however i happen to this mesg again...

kindly let me know is there any other alternative to overcome this...

thanks