Search Site

Search Rules

Account

email
password

not registered?

can't login?

user preferences

Configuration

By default, all alerts are enabled and the preprocessor checks traffic on port 22.

The available configuration options are described below.

62.

server_ports $\{ <$port$> [<$port$> <...>] \}$

This option specifies which ports the SSH preprocessor should inspect traffic to.

63.

max_encrypted_packets $<$ number $>$

Specifies the number of unanswered packets to allow before alerting on Gobbles or CRC 32. In Gobbles or CRC 32, several large packets will be transmitted immediately after the authentication challenge. max_encrypted_packets should be used in combination with max_client_bytes.

64.

max_client_bytes $<$ number $>$

The maximum number of bytes allowed to be transferred across max_encrypted_packets packets before alerting on Gobbles or CRC 32.

65.

autodetect

Attempt to automatically detect SSH.

66.

disable_gobbles

Disables checking for the Gobbles exploit.

67.

disable_ssh1crc32

Disables checking for the CRC 32 exploit.

68.

disable_srvoverflow

Disables checking for the Secure CRT exploit.

69.

disable_protomismatch

Disables checking for the Protocol Mismatch exploit.

70.

disable_badmsgdir

Disable alerts for traffic flowing the wrong direction. For instance, if the presumed server generates client traffic, or if a client generates server traffic.

71.

disable_paysize

Disables alerts for invalid payload sizes.

72.

disable_recognition

Disable alerts for non-SSH traffic on SSH ports.

The SSH preprocessor should work by default. After max_client_packets is reached, the preprocessor will stop processing traffic for a given session. If Gobbles or CRC 32 false positive, try increasing the number of required client bytes with max_client_bytes.

site feedback | Terms of Use | Privacy Policy | forum archives ©2008 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.