Keystroke detection

[David]

On 14/12/2012 22:10, John Gerth wrote:
> On 12/14/2012 1:31 PM, Craig Merchant wrote:
>> What client tools do I need to use to look for keystroke detection in encrypted sessions?
>>
> There are two facets to SSH keystroke detection:
> 
> (1) telling the sensor to look for keystrokes in argus.conf
>   ARGUS_KEYSTROKE="ssh"

Out of interest how does this handle other things that SSH can do, such
as network tunneling, agent forwarding etc?

Will packets containing that data also count as "keystrokes", because
Argus cannot discern their contents?

David