From 634fe5b9e2a0180a41b176c41d2b4b37d2bfbd22 Mon Sep 17 00:00:00 2001
From: Russ Allbery <rra@stanford.edu>
Date: Tue, 1 Apr 2014 20:21:32 -0700
Subject: [PATCH] Ignore another ssh port scan error

---
 files/ssh/etc/filter-syslog/ssh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/files/ssh/etc/filter-syslog/ssh b/files/ssh/etc/filter-syslog/ssh
index 4cf4902..be19463 100644
--- a/files/ssh/etc/filter-syslog/ssh
+++ b/files/ssh/etc/filter-syslog/ssh
@@ -32,6 +32,7 @@ sshd: /^Bad protocol version identification 'GET / HTTP/1.1' from UNKNOWN$/
 sshd: /^Connection closed by (UNKNOWN|[:a-f\d.]+)$/
 sshd: /^Did not receive identification string from ([:a-f\d.]+|UNKNOWN)$/
 sshd: /^Protocol major versions differ for ([:a-f\d.]+|UNKNOWN): /
+sshd: /^dispatch_protocol_error: type \d+ seq \d+ \[preauth\]$/
 sshd: /^fatal: Read from socket failed: Connection reset by peer/
 sshd: /^fatal: Timeout before authentication for [:a-f\d.]+$/
 sshd: /^(pam_unix\(sshd:auth\)|\(pam_unix\)):? check pass; user unknown$/
-- 
GitLab