Which IP is causing this error message and what is 'happy111'?

I seem to have a webapi access every few seconds that is causing a logged error but I don’t know from which IP it is coming from - can I find it somehow - except by WireShark ? Does that ‘happy111’ mean anything to anyone ? It’s not one of my passwords.

2019-06-29 13:33:05 WARNING (MainThread) [homeassistant.components.websocket_api.http.connection.1740474800] Auth message incorrectly formatted: extra keys not allowed @ data['Redacted']. Got 'happy111'

netstat allows me to see the current TCP connections - but this is a transient connection every few seconds, might even be from a loopback address. Is there any way to get netstat to ‘listen’ and output any new TCP connection details rather than terminating after listing all current ones ?

K

From the netstat man page

-c, --continuous

This will cause netstat to print the selected information every second continuously.

Someone using improperly formated login with happy111?

Closing WAN connection to HA will quickly answer if on your network or outside network

Just wanted to let you know I found it - it was a websocket access from nodeRED that used to work and now doesn’t - from my other HA install. I am guessing ‘happy111’ is maybe some default password in the nodeRED component

image

Easy to overlook and a logged IP in the error message would have been very helpful.

Now I’ve just got to eliminate these on the other OH - hundreds of thousand error messages… but looks like a know ‘open’ issue on GitHub

11:05 PM /usr/src/homeassistant/homeassistant/core.py (ERROR) - message first occured at 
9:03 PM and shows up 145459 times

Mon Jul 01 2019 23:05:54 GMT+0100 (British Summer Time)
Error doing job: SSL handshake failed
Traceback (most recent call last):
  File "uvloop/sslproto.pyx", line 500, in uvloop.loop.SSLProtocol._on_handshake_complete
  File "uvloop/sslproto.pyx", line 484, in uvloop.loop.SSLProtocol._do_handshake
  File "/usr/local/lib/python3.7/ssl.py", line 763, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: TLSV1_ALERT_DECRYPT_ERROR] tlsv1 alert decrypt error (_ssl.c:1056)