suspicious users on sh users

[adrian.mollenhorst]

Hi,

I can see the following on sh users command:

The 123 and 122 networks are suspicious and I have tried to kick them off clearing those vty lines, but they remain. I have added an access list so only internal users get access to this router.

Do I need to reload to get rid of these, or can I safely assume its old info, nothing to worry about?

[Georg Pauwen · Accepted solution]

Hello, 

try the following:

sh tcp brief

You output will list the TCB (Transmission Control Block) associated with the line.

R1#sh tcp brief
TCB Local Address Foreign Address (state)
682016A0 192.168.1.1.179 192.168.1.2.55203 ESTAB

Clear the tcp associated with the line:

clear tcp tcp 682016A0

[adrian.mollenhorst]

Excellent, that worked a treat Georg. 

Thanks

Adrian