diff --git a/filters/ssh.preg b/filters/ssh.preg
index d1c63a1..940dafb 100644
--- a/filters/ssh.preg
+++ b/filters/ssh.preg
@@ -5,7 +5,7 @@ refused connect from [[:print:]]+ \(<HOST>\)
 Received disconnect from <HOST>: [0-9]*: [[:print:]]+: Auth fail
 Did not receive identification string from <HOST>
 Invalid user [[:print:]]+ from <HOST>
-Connection closed by <HOST> \[preauth\]
+Connection closed by <HOST>( port [0-9]+)? \[preauth\]
 Postponed keyboard-interactive for invalid user [[:print:]]+ from <HOST> port [0-9]+
 User [[:print:]]+ from <HOST> not allowed because not listed in AllowUsers
 User [[:print:]]+ from <HOST> not allowed because listed in DenyUsers