I noticed randomly our CR routers have a lot of this in the logs, the IPs in each case appear to be the local prometheus instances:
cmooney@re0.cr1-eqiad> show log messages | match "Did not receive identification string|/usr/sbin/sshd" Jun 26 06:00:58 re0.cr1-eqiad sshd[18240]: Did not receive identification string from 10.64.0.82 port 35834 Jun 26 06:00:58 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[18240]: exited, status 255 Jun 26 06:03:44 re0.cr1-eqiad sshd[18375]: Did not receive identification string from 10.64.16.62 port 39704 Jun 26 06:03:44 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[18375]: exited, status 255 Jun 26 06:04:58 re0.cr1-eqiad sshd[18419]: Did not receive identification string from 10.64.0.82 port 41180 Jun 26 06:04:58 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[18419]: exited, status 255 Jun 26 06:07:44 re0.cr1-eqiad sshd[18587]: Did not receive identification string from 10.64.16.62 port 40044 Jun 26 06:07:44 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[18587]: exited, status 255 Jun 26 06:08:58 re0.cr1-eqiad sshd[18633]: Did not receive identification string from 10.64.0.82 port 49898 Jun 26 06:08:58 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[18633]: exited, status 255 Jun 26 06:11:44 re0.cr1-eqiad sshd[18788]: Did not receive identification string from 10.64.16.62 port 51994 Jun 26 06:11:44 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[18788]: exited, status 255 Jun 26 06:12:58 re0.cr1-eqiad sshd[18838]: Did not receive identification string from 10.64.0.82 port 36248 Jun 26 06:12:58 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[18838]: exited, status 255 Jun 26 06:15:44 re0.cr1-eqiad sshd[19005]: Did not receive identification string from 10.64.16.62 port 35270 Jun 26 06:15:44 re0.cr1-eqiad inetd[29367]: /usr/sbin/sshd[19005]: exited, status 255
Need to investigate the cause, are these failed SSH attempts from prometheus hosts to the routers?