freebsd security - Jul 2003 - tcp 22 > tcp 22

Hi,

I spotted today following line at my FreeBSD 4.6.2-RELEASE IPFIREWALL log:

Jul  1 13:34:35 fbsd /kernel: ipfw: 1400 Accept TCP xxxxxx:22 yyyyy:22 in via 
ed1

where xxxxxx is the attacker's IP and yyyyy is my box.

But in sshd log, there are no traces left behind by this connection.
Normally, there is "Did not receive identification string from xxx"
etc, when
somebody tries to scan SSH port.

Also, as you can see, the connection is made from port 22 to port 22, which is 
odd.

Is this somekind of SYN packet trick and how come is no I/O to sshd made?

sshd -v shows:
sshd version OpenSSH_3.4p1 FreeBSD-20020702
---
Regards,
Tarmo Renter

> Jul  1 13:34:35 fbsd /kernel: ipfw: 1400 Accept TCP xxxxxx:22 yyyyy:22 in
via
> ed1
> where xxxxxx is the attacker's IP and yyyyy is my box.
> Also, as you can see, the connection is made from port 22 to port 22, which
is
> odd.
http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=22441 -
maybe this could explain your case?

-- 
Nikolaj I. Potanin, SA                          http://www.drweb.ru
ID Anti-Virus Lab (SalD Ltd)                    nikolaj@drweb.ru
St. Petersburg, Russia                          ph.: +7-812-3888624