1

Does this mean, that someone is trying to get login over SSH/Telnet to my ASA? If not, can someone explain me this log?

enter image description here

When there only is a Built outbound UDP connection 6947 for outside:8.8.8.8/53 (8.8.8.8/53) to inside:10.0.0.168/48411 (PublicIP/48411) it means that I have opened a Website in Browser and it sends me an Response - Am I right?

1
  • Short version: YES. But not you specifically.
    – Ricky
    May 24, 2016 at 19:55

2 Answers 2

4

Does this mean that someone is trying to get login over SSH/Telnet to my ASA?

Well, yes. But you can expect to see that hundreds or thousands of times a day. Welcome to the Internet. If you don't allow SSH or telnet from the outside interface, this is just noise.

it means that I have opened a Website in Browser and it sends me an Response - Am I right?

It means you have made a DNS query to Google. If it were a website, you would see a connection to TCP port 80.

3
  • Its my first time seeing the log. I think I arrived at the Internet. So these are some scripts which try all IPs in the world if they can login over SSH and Telnet, just to hack someone? So I shouldn't get stressed about this? Okay thanks! :-) May 24, 2016 at 13:25
  • Additionally, it's not uncommon to see ping sweeps (if you have multiple public IPs behind your firewall) and port scans throughout the day. Be careful that you don't overwhelm your logs with this stuff. May 24, 2016 at 19:05
  • I saved the log. In 12 Hours "only" 40 attemps. This is crazy :o May 25, 2016 at 6:58
3

watch the logs for a day. there will thousands of attempts to access your public servers on a bunch of well known ports.

But i would not be worried. it happens all day and night. people actually trying to 'hack' your network or just some school kid that got a hold of metasploit

2
  • This will continue 24x7x365. The attempts are automated, especially for known residential networks. This is because home users are typically naive about security.
    – Ron Maupin
    May 24, 2016 at 18:12
  • So some people are espacially looking for home networks, just to do something bad? I knew that there is a lot of things going on in the internet, but i didn't knew that it's so much. But thanks for the information. I will study all the log entrys. May 25, 2016 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.