Is my router scanning my internal network?

[davemacrae]

I've been noticing an increased number of invalid ssh login attempts to some, but not all, of the devices in my network:

For example:

Dec 27 09:45:27 pizw sshd[32415]: Failed password for invalid user Recorder from 192.168.1.1 port 54310 ssh2
Dec 27 09:46:29 pizw sshd[32432]: Failed password for invalid user Recorder from 192.168.1.1 port 54324 ssh2
Dec 27 09:46:33 pizw sshd[32434]: Failed password for invalid user admin from 192.168.1.1 port 54326 ssh2
Dec 27 09:46:37 pizw sshd[32443]: Failed password for invalid user admin from 192.168.1.1 port 54328 ssh2
Dec 27 09:47:40 pizw sshd[32452]: Failed password for invalid user admin from 192.168.1.1 port 54348 ssh2
Dec 27 09:47:44 pizw sshd[32454]: Failed password for invalid user admin from 192.168.1.1 port 54350 ssh2
Dec 27 09:47:48 pizw sshd[32463]: Failed password for invalid user nzbget from 192.168.1.1 port 54352 ssh2
Dec 27 09:48:52 pizw sshd[32480]: Failed password for invalid user 101 from 192.168.1.1 port 54366 ssh2

Are these being generated by my router?

[Cynric]

@davemacrae Your log shows multiple attempts to logon to the router.

[Ripshod]

What device is that log from? I assume not the router? 

[Cynric]

That depends on the router address 😁

But I thought the format looked like the router log. PIZW I think relates to the USB interface on some devices.