@nightpool@cybre.space tcp 0 0 192.168.1.64:ssh 192.168.1.20:52703 ESTABLISHED
tcp 0 0 192.168.1.64:ssh 192.168.1.20:57622 ESTABLISHED
tcp 0 1 192.168.1.64:ssh 192.168.1.1:25186 FIN_WAIT1

20 is me, 1.1 is an attacker bruteforcing me?