ET SCAN Potential SSH Scan OUTBOUND SSH

[xokia]

I have snort running and started seeing this lately. How do I investigate which application is trying to connect to SSH?

192.168.3.12 is my home server running unraid. Which runs a plex server and some other apps. I do not have sftp nor ssh enabled so I should have nothing trying to connect to SSH.

[mcury]

@xokia

https://forums.unraid.net/topic/127330-flash-backup-activated-not-up-to-date-flash-backup-unavailable/

https://www.reddit.com/r/unRAID/comments/o25ra2/port_22_connection/

[xokia]

@mcury interesting I will have to look more. I do have usb backup but have had it for a while and this snort issue just recently started popping up. My backup still does work as far as I can tell.