"user access disconnected" messages logged when a utility, or monitor tool scans tcp port 1680