One of my machines seems to be trying to connect to port 22 on random hosts on the internet. I would like to use Wireshark to determine which of my machines is the culprit. I have tried this as a capture filter:
port 22 and not dst net 192.168.1.0 mask 255.255.255.0
But my network accepts SSH connections, so it is constantly bombarded with connection attempt from random hosts on the internet. The responses to these connection attempts are not filtered out and are so many that I cannot find the connections I initiate.
How can I filter out all packets associated with SSH connections that I do not initiate?
