6 ms·
SSH protocol version exchange is before key exchange. Is this not easily identified in both Clint and server side packet analysis? I appreciate that SSH can b
by vgb2k18 3y ago
SSH protocol version exchange is before key exchange. Is this not easily identified in both Clint and server side packet analysis?
I appreciate that SSH can be obsfucated via an SSL tunnel but the article didn't come at that angle.
The article itself even states:
>with SSH everything goes dark right after the initial capabilities exchange.
So... What say about before the exchange?
- meithecatte 3y agoThey want to consider normal connections legitimate, and only detect tunnels.
- vgb2k18 3y agoForgive me, my grok ability is low right now. I read the section about detecting TTY traffic, and in my mind, TTY traffic would be an example of a legit normal connection. Engineer accessing the system, etc.
- cwillu 3y agoI routinely use both forward and reverse tunnels in my day-to-day ssh use.