Is my router scanning my internal network?

[davemacrae]

I've been noticing an increased number of invalid ssh login attempts to some, but not all, of the devices in my network:

For example:

Dec 27 09:45:27 pizw sshd[32415]: Failed password for invalid user Recorder from 192.168.1.1 port 54310 ssh2
Dec 27 09:46:29 pizw sshd[32432]: Failed password for invalid user Recorder from 192.168.1.1 port 54324 ssh2
Dec 27 09:46:33 pizw sshd[32434]: Failed password for invalid user admin from 192.168.1.1 port 54326 ssh2
Dec 27 09:46:37 pizw sshd[32443]: Failed password for invalid user admin from 192.168.1.1 port 54328 ssh2
Dec 27 09:47:40 pizw sshd[32452]: Failed password for invalid user admin from 192.168.1.1 port 54348 ssh2
Dec 27 09:47:44 pizw sshd[32454]: Failed password for invalid user admin from 192.168.1.1 port 54350 ssh2
Dec 27 09:47:48 pizw sshd[32463]: Failed password for invalid user nzbget from 192.168.1.1 port 54352 ssh2
Dec 27 09:48:52 pizw sshd[32480]: Failed password for invalid user 101 from 192.168.1.1 port 54366 ssh2

Are these being generated by my router?

[Cynric]

Is it worth running Wireshark or one of the Unix packet sniffers?

[davemacrae]

Good idea, I'll give that a try. 

[davemacrae]

I already have an RPI running pihole as a DHCP sever.

While I quoted the logs from my Pi Zero W I see the same thing happening to a couple of the other  servers, but not all, in my internal network.

[madmuso]

@davemacrae Interested to note that you still had the issue when you disconnected the router from the internet.  Have you thought of whether any other devices in your internal or even guest networks could be generating the traffic and somehow making it look like it is coming from the router.
That said it is clear to me that the DGM4980VDF is capable of a lot more than is exposed in the GUI.  I was offered the chance to sign up for a trial of using the Wifi mesh to detect whether there were people in the house or not.

[davemacrae]

I still haven't had a response from Vodafone on this. Is it worth contacting the directly?

[Jayach]

---

@davemacrae wrote:

I still haven't had a response from Vodafone on this. Is it worth contacting the directly?

---

How would you expect a response from them, if you haven't contacted them directly? They will never reply via the forum.

But, personally, I doubt they will be any help.