>Can you create a version with more detailed logging of the initial stages >of connection? I would like to know if this is a human login or a port >probe. >
Looks like a simple connect, then disconnect. Could be a probe or human. If it's a probe the connect at and disconnect times will be closer together than a human i'd guess. The probes will scan the string as a response, then disconnect.
