Recently I saw a port scan on my ubuntu server.
The log lines in auth.log look like this:
Jul 2 01:14:30 host12907 sshd[14010]: Failed password for root from 64.225.102.51 port 41676 ssh2
Jul 2 01:14:30 host12907 sshd[14011]: Failed password for root from 64.225.102.51 port 41696 ssh2
Jul 2...
