Hello to all,
If this is not the appropriate section, then apologies.

I have a linux device on my lan which is always turned on. I've noticed that occasionally when I run the 'netstat' command, It seems as if someone is running a remote SSH session on the device. The output is as follow, (including only the line I'm interested in).

Code:
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0    360 192.168.1.101:ssh       202.105.49.*:38954     ESTABLISHED
The SSH port is being forwarded to this device through my router so that I can access it remotely.

From what I've read about netstat, I assume that the above is something I should be worried about?

Running the 'last' and 'who' commands turns up nothing except my own activities.

The box is running a variant of Tuxbox, its stripped down so the command set is limited.

What do you guys think?

Any info would be much appreciated.

Rgds,
C