zeek/scripts/base/protocols/ssh/dpd.sig

13 lines
No EOL
264 B
Standard ML

signature dpd_ssh_client {
ip-proto == tcp
payload /^[sS][sS][hH]-[12]\./
requires-reverse-signature dpd_ssh_server
enable "ssh"
tcp-state originator
}
signature dpd_ssh_server {
ip-proto == tcp
payload /^[sS][sS][hH]-[12]\./
tcp-state responder
}