Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Refactored the SSH analyzer. Added supported for algorithm detection and more key exchange message types.

Browse source
This commit is contained in:
Vlad Grigorescu 2015-01-13 12:02:31 -05:00
parent 245bd07af7
commit 05ecac2497
11 changed files with 745 additions and 328 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/base/protocols/ssh/dpd.sig
View file

@ -1,6 +1,13 @@
signature dpd_ssh {
signature dpd_ssh_client {
ip-proto == tcp
payload /^[sS][sS][hH]-[12]./
payload /^[sS][sS][hH]-[12]\./
requires-reverse-signature dpd_ssh_server
enable "ssh"
tcp-state originator
}
signature dpd_ssh_server {
ip-proto == tcp
payload /^[sS][sS][hH]-[12]\./
tcp-state responder
}