Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Testing a fix for SSH login detection heuristic.

Browse source
This commit is contained in:
Seth Hall 2011-10-25 00:01:04 -04:00
parent 7f838b6181
commit e6a8489780
1 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/base/protocols/ssh/main.bro
View file

@ -107,21 +107,25 @@ function check_ssh_connection(c: connection, done: bool)
if ( !c$resp?$num_bytes_ip )
return;
local server_bytes = c$resp$num_bytes_ip -
c$resp$num_pkts*32 - # Cut the TCP header
c$resp$num_pkts*20; # Cut the IP header (TODO: fix for IPv6)
# If this is still a live connection and the byte count has not
# crossed the threshold, just return and let the resheduled check happen later.
if ( !done && c$resp$num_bytes_ip < authentication_data_size )
if ( !done && server_bytes < authentication_data_size )
return;
# Make sure the server has sent back more than 50 bytes to filter out
# hosts that are just port scanning. Nothing is ever logged if the server
# doesn't send back at least 50 bytes.
if ( c$resp$num_bytes_ip < 50 )
if ( server_bytes < 50 )
return;
c$ssh$direction = Site::is_local_addr(c$id$orig_h) ? OUTBOUND : INBOUND;
c$ssh$resp_size = c$resp$num_bytes_ip;
c$ssh$resp_size = server_bytes;
if ( c$resp$num_bytes_ip < authentication_data_size )
if ( server_bytes < authentication_data_size )
{
c$ssh$status = "failure";
event SSH::heuristic_failed_login(c);