We just saw a problem statement where we can't figure out the difference between brute force attempts through PCAP analysis. One reason for this failure is that there is an encryption in place, and we can't make out the encrypted content differences. Let's investigate the SSH login logs from the server and see if we can understand what happened.
SSH authentication logs in Linux are generally stored in the /var/log/access.log file.
Let's open the raw access.log file and check whether or not we can get something of interest:
Oops! There are just too many authentication failures. It was a brute force attack. Let's check ...
