Suricata

I noticed that rules based on SSH banner-related keywords only matched if the data is acknowledged by both client and server.
SSH fields used in the rule are however always present in the eve.json files.

I attached:

• some pcaps with minimal examples with a TCP three-way handshake, incomplete or complete SSH banner exchange and a final RST from the client.
• a file with some rules.

Here is the test case descriptions, the expected behavior, and the observed behavior:

• Case 1 - SB: only server sends its banner - rules match - rules do not match.
• Case 2 - SBCA: server sends its banner and client acks it - rules match - rules do not match.
• Case 3 - SBCB: server sends its banner and client sends its banner - rules match - rules do not match.
• Case 4 - SBCBSA: server sends its banner, client sends its banner, and server server the client's banner - rules match - rules match.