I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications.

A brute force attack was made by myself, from a Kali Linux machine and the software I use was Metasploit.

In Kali Linux when I ran the nmap command on the target machine, I looked instantly at Windows Event Viewer and received this SSH notification:

  • “sshd: Did not receive identification string from ipaddress on port portnumber

I was hoping to receive information about the attacker machine (Linux) such as name of machine or user or is this not possible?

  • what information are you looking for? – Vipul Nair Jan 26 at 12:42
  • Information about the attacker or the Linux machine. All I’m receiving is the IP address. Just wondering if it’s an issue with the SSH server or that’s all the Event Log presents – C.Mann Jan 26 at 12:43
  • What attack was made?What information are you hoping to gain other than ip address?Be a bit more specific in the question. – Vipul Nair Jan 26 at 12:52
  • Brute force attack. Information such as the name of the attacker machine or the name of user that implemented the attack – C.Mann Jan 26 at 13:07
  • Why would a scanning tool send information about the person using it? It would have to know how to speak the protocol in order to communicate over it, but I don't understand the premise behind this question. – multithr3at3d Jan 26 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.