# Ungraceful Disconnects from unknown clients

**URL:** <https://community.hivemq.com/t/ungraceful-disconnects-from-unknown-clients/229>\
**Category:** HiveMQ Community Edition\
**Created:** [June 3, 2020, 9:56pm UTC](https://community.hivemq.com/t/ungraceful-disconnects-from-unknown-clients/229 "2020-06-03T21:56:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ryantaylortnp](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@ryantaylortnp](https://community.hivemq.com/u/ryantaylortnp)\
**Post date:** [June 3, 2020, 9:56pm UTC](https://community.hivemq.com/t/ungraceful-disconnects-from-unknown-clients/229/1 "2020-06-03T21:56:24Z")

</div>

I am running a single-node instance of HiveMQ CE on Ubuntu 18.04 for a production system that is open to the internet on a non-standard MQTT port. Periodically (2-4 times per day, for about 10-30 minutes) I see a large number of messages in event.log identical to the following:

```auto
[TIMESTAMP] - Client ID: UNKNOWN, IP: UNKNOWN disconnected ungracefully.

```

I see the CPU usage of our machine climb steadily during this period, as well as the rate of DISCONNECT messages (although our 15k+ clients stay connected at a normal level). I have not found any relevant information anywhere on the web, and without a ClientID or source IP address, I’m not sure how to trace where this traffic is coming from.

Is it possible that someone is discovering our server with a port-scanning tool? Do I have a configuration parameter set incorrectly?

---

<div class="post-metadata">

**Author:** ![ryantaylortnp](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@ryantaylortnp](https://community.hivemq.com/u/ryantaylortnp)\
**Post date:** [June 3, 2020, 9:58pm UTC](https://community.hivemq.com/t/ungraceful-disconnects-from-unknown-clients/229/2 "2020-06-03T21:58:10Z")

</div>

I also see these messages periodically:

` [TIMESTAMP - Client ID: UNKNOWN, IP: UNKNOWN was disconnected. reason: SSL handshake failed.`

---

<div class="post-metadata">

**Author:** ![zingiber](https://avatars.discourse-cdn.com/v4/letter/z/ce73a5/32.png) [@zingiber](https://community.hivemq.com/u/zingiber)\
**Post date:** [June 8, 2020, 3:46pm UTC](https://community.hivemq.com/t/ungraceful-disconnects-from-unknown-clients/229/3 "2020-06-08T15:46:02Z")

</div>

Hey @ryantaylortnp,

since your environment is reachable from the internet, this is likely the result of port scans.  
The log message you are seeing would match the behaviour of a client (or port scanning utility) establishing a TCP connection with the broker completing further steps.  
This in an of itself is no reason to worry.

Side note: You could consider logging all incoming TCP connections and determining if there are recurring IPs in these connection spikes, which then could be blocked via firewall.

Kind regards,  
Finn