many preauth sshd disconnects-- what do they mean?

[William Unruh]

I am getting many many entries in my logs like the following
Feb 5 11:34:20 dilaton sshd[10795]: Received disconnect from 116.31.116.27: 11: [preauth]
Feb 5 11:34:33 dilaton sshd[10797]: Received disconnect from 112.85.42.123: 11: [preauth]
Feb 5 11:35:05 dilaton sshd[10800]: Received disconnect from 116.31.116.27: 11: [preauth]
Feb 5 11:35:16 dilaton sshd[10802]: Could not write ident string to 112.85.42.123
Feb 5 11:35:50 dilaton sshd[10804]: Received disconnect from 116.31.116.27: 11: [preauth]
Feb 5 11:35:52 dilaton sshd[10805]: Received disconnect from 112.85.42.123: 11: [preauth]

What does this string mean? It does not seem that a connection was ever
made, and I assume this is some sort of attack, but what?

[Bit Twister]

On Thu, 9 Feb 2017 09:03:56 -0000 (UTC), William Unruh wrote:
> I am getting many many entries in my logs like the following
> Feb 5 11:34:20 dilaton sshd[10795]: Received disconnect from 116.31.116.27: 11: [preauth]

> What does this string mean? It does not seem that a connection was ever
> made, and I assume this is some sort of attack, but what?
>

Have you tried putting
11: [preauth]
in the second box at https://encrypted.google.com/advanced_search

[William Unruh]

No I had not, not knowing what to look for. Thanks. Still does not give
me much information unfortunately.

[Doug Laidlaw]

William Unruh <un...@invalid.ca> Wrote in message:

http://unix.stackexchange.com/questions/102502/
meaning-of-connection-closed-by-xxx-preauth-in-sshd-logs

came up on my search. Google may have shown you a different
selection.

Doug.
--