Project

General

Custom queries

Profile

Actions

Bug #4636

closed

Rules based on SSH banner-related keywords only match on acked data

Added by Jeff Lucovsky over 3 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

I noticed that rules based on SSH banner-related keywords only matched if the data is acknowledged by both client and server.
SSH fields used in the rule are however always present in the eve.json files.

I attached:
  • some pcaps with minimal examples with a TCP three-way handshake, incomplete or complete SSH banner exchange and a final RST from the client.
  • a file with some rules.
Here is the test case descriptions, the expected behavior, and the observed behavior:
  • Case 1 - SB: only server sends its banner - rules match - rules do not match.
  • Case 2 - SBCA: server sends its banner and client acks it - rules match - rules do not match.
  • Case 3 - SBCB: server sends its banner and client sends its banner - rules match - rules do not match.
  • Case 4 - SBCBSA: server sends its banner, client sends its banner, and server server the client's banner - rules match - rules match.

Files

custom_SSH_SBCA.pcap (594 Bytes) custom_SSH_SBCA.pcap Case 2 Johan Mazel, 07/26/2021 12:50 PM
custom_SSH_SB.pcap (524 Bytes) custom_SSH_SB.pcap Case 1 Johan Mazel, 07/26/2021 12:50 PM
custom_SSH_SBCBSA.pcap (784 Bytes) custom_SSH_SBCBSA.pcap Case 4 Johan Mazel, 07/26/2021 12:50 PM
custom_SSH_SBCB.pcap (714 Bytes) custom_SSH_SBCB.pcap Case 3 Johan Mazel, 07/26/2021 12:50 PM
suricata_ssh.rules (534 Bytes) suricata_ssh.rules SSH rules Johan Mazel, 07/26/2021 12:51 PM

Related issues 1 (0 open1 closed)

Copied from Suricata - Bug #4563: Rules based on SSH banner-related keywords only match on acked dataClosedShivani BhardwajActions
Actions #1

Updated by Jeff Lucovsky over 3 years ago

  • Copied from Bug #4563: Rules based on SSH banner-related keywords only match on acked data added
Actions #2

Updated by Shivani Bhardwaj over 3 years ago

  • Label Needs backport to 6.0 added
Actions #3

Updated by Shivani Bhardwaj over 3 years ago

  • Label deleted (Needs backport to 6.0)
Actions #4

Updated by Shivani Bhardwaj about 3 years ago

  • Private changed from Yes to No
Actions #5

Updated by Shivani Bhardwaj about 3 years ago

  • Status changed from Assigned to In Review
Actions #6

Updated by Victor Julien about 3 years ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF