Project

General

Profile

Actions

Bug #4636

closed

Rules based on SSH banner-related keywords only match on acked data

Added by Jeff Lucovsky over 2 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

I noticed that rules based on SSH banner-related keywords only matched if the data is acknowledged by both client and server.
SSH fields used in the rule are however always present in the eve.json files.

I attached:
  • some pcaps with minimal examples with a TCP three-way handshake, incomplete or complete SSH banner exchange and a final RST from the client.
  • a file with some rules.
Here is the test case descriptions, the expected behavior, and the observed behavior:
  • Case 1 - SB: only server sends its banner - rules match - rules do not match.
  • Case 2 - SBCA: server sends its banner and client acks it - rules match - rules do not match.
  • Case 3 - SBCB: server sends its banner and client sends its banner - rules match - rules do not match.
  • Case 4 - SBCBSA: server sends its banner, client sends its banner, and server server the client's banner - rules match - rules match.

Files

custom_SSH_SBCA.pcap (594 Bytes) custom_SSH_SBCA.pcap Case 2 Johan Mazel, 07/26/2021 12:50 PM
custom_SSH_SB.pcap (524 Bytes) custom_SSH_SB.pcap Case 1 Johan Mazel, 07/26/2021 12:50 PM
custom_SSH_SBCBSA.pcap (784 Bytes) custom_SSH_SBCBSA.pcap Case 4 Johan Mazel, 07/26/2021 12:50 PM
custom_SSH_SBCB.pcap (714 Bytes) custom_SSH_SBCB.pcap Case 3 Johan Mazel, 07/26/2021 12:50 PM
suricata_ssh.rules (534 Bytes) suricata_ssh.rules SSH rules Johan Mazel, 07/26/2021 12:51 PM

Related issues 1 (0 open1 closed)

Copied from Suricata - Bug #4563: Rules based on SSH banner-related keywords only match on acked dataClosedShivani BhardwajActions
Actions

Also available in: Atom PDF