Half connections to determine availability/existence of SSH is exactly what botnets/nefarious actors do. If you know why you have incomplete connections in your logs, then you can filter/ignore them.. those should only be from known IP blocks which you can filter out, but it's unwise to write all off that traffic as "known"
back
1 comments
I agree. My comment was clarifying that your blanket statement implied "if this is seen, it is a problem" and I was providing contradictory evidence that no, it does not always indicate a problem. I personally have been known to telnet to ip:22 while debugging "why doesn't this work"; half-connects are just a part of life, used for both good and evil.