# How do I know if someone is brute-forcing our SSH servers right now?

Look at the server's authentication log: many failed logins for root, admin or random user names, from one address or many, are the classic sign, and tools such as Fail2ban count them for you. On an internet-facing server some of this is constant background noise; what matters is whether any attempt succeeded, so look for successful logins from unfamiliar addresses, at odd hours or for accounts that rarely log in, and check that password logins are disabled. Attempts from inside your own network are more serious, because they mean a compromised host is doing the guessing. NetSenX flags repeated login attempts against monitored hosts as brute force, on every plan, together with scanning and unusual sessions, so attempts from an internal host stand out. It cannot tell from the network whether a password was accepted; the server's log can.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/how-to-know-if-someone-is-brute-forcing-our-ssh-servers

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/blog/2026-11-06_sshole-cve-2026-123158

## Related questions

- [Are we affected by OpenSSH flaws such as regreSSHion?](https://netsenx.com/en/faq/are-we-affected-by-openssh-flaws-like-regresshion)
- [Can malware travel back to my computer over an SSH session?](https://netsenx.com/en/faq/can-malware-travel-back-over-an-ssh-session)
- [How can SSH tunnels bypass a firewall?](https://netsenx.com/en/faq/how-can-ssh-tunnels-bypass-a-firewall)
- [Is it safe to use SSH over public Wi-Fi?](https://netsenx.com/en/faq/is-ssh-over-public-wifi-safe)
- [How dangerous is port forwarding to a server in the office?](https://netsenx.com/en/faq/how-dangerous-is-port-forwarding-for-an-office-server)