The username is hiding in the packet
Five sessions completed a normal SSH handshake and then sent an authentication request the server refused to parse. The raw bytes are still logged, and an SSH auth request begins with a length-prefixed username, so the name is recoverable directly from the hex. Two names come out, both random strings, spread across five different source addresses - which makes this one tool generating a throwaway identity per run, not five unrelated attackers.
Five packets this week were too broken to process. The bytes were kept anyway.
When a packet fails to parse, most software logs that it failed and moves on. The content is treated as noise, because it did not fit.
It is not noise. All five got through the handshake fine and then sent an authentication request that the parser refused. The raw bytes were recorded.
An authentication request starts with the username, preceded by its length. So take the bytes after that length and turn them back into text.
Two names come out. Both are random strings, the kind a script generates once per run and throws away.
Five different source addresses, two names between them. That is not five attackers. That is one tool, run twice, from whatever machines it had.
The packet was broken. It still identified its author.
Keep the raw bytes. A rejected packet still says something.
#linux#security#selfhosted#infosec#sysadmin
❯ Keep the raw bytes. A rejected packet still says something.