What does ESTABLISHED mean in netstat?

Question

linux

Greetings.
There is a VPS server, with a completely reinstalled OS. You start checking nestat and as a result of the command, there is information about 5 unauthorized ssh connections.
The state of these connections is ESTABLISHED. Why is the state written like that, given that there is a bruteforce, how can the connection be ESTABLISHED?

Answer 1

Someone successfully opened a connection to port 22, but it's not at all a fact that he moved on. Most likely - they sit, sort out passwords. In general - close the password entry and leave only the authorization by key, and let them try to pick up the carrot charm :).