[Snort-sigs] Signature for scanning SSH versions

Jukka Juslin jtjuslin at ...1151...
Thu Jul 24 02:22:01 EDT 2003


Would is be possible to have a signature to capture SSH server version
scanning? There is one signature in the rules package, but it doesn't
really detect basic thing, when somebody just queries the SSH-XXXXX header
and then exists.

Does anybody have a signature like this?


More information about the Snort-sigs mailing list