Detecting unusual SSH traffic...

[Craig Merchant]

I'd like to use Argus to monitor the network for outbound SSH connections to unusual ports.  I'm guessing that the best way to do this would be to enable the ARGUS_CAPTURE_DATA_LEN feature in argus.conf and then use the regular expression feature of ra clients to look for "SSH".

I set the capture length to 192.  I ran the following:

ra -S 192.168.174.41:561 -n -M dsrs="+duser,+suser" -e "^SSH-" -s +suder,+duser

I would expect the user data fields with the "SSH-2.0-" in it to pass the filter, but not the other lines.  I tried a regex that wouldn't match anything and now flows showed up.  It's almost like ra is matching 22 against SSH even though port labels are disabled with -n.

   22:08:18.820140  e s         tcp       192.168.60.85.22        ->        192.150.4.28.40511        14       1904   FIN d[10]=SSH-2.0-Op
   22:08:18.996308  e g         tcp       192.135.13.32.22       <?>        192.150.4.28.33953        11       1152   FIN d[10]=SSH-2.0-Op
   22:08:19.025720  e s         tcp       192.168.60.60.22        ->        192.158.1.13.32791        22       6480   FIN d[10]=SSH-2.0-SS
   22:08:19.187967  e s         tcp       192.168.60.61.22       <?>        192.158.1.13.35880        22       4168   FIN d[10]=....95Q...
   22:08:19.319604  e s         tcp       192.135.13.43.22       <?>        192.150.4.28.33433        14       2674   CON d[10]=....."....
   22:08:19.352756  e d         tcp        192.150.4.28.40515    <?>       192.168.60.85.22           24       2892   FIN d[10]=..........
   22:08:19.494457  e g         tcp       192.168.60.63.22        ->        192.158.1.13.42038        18       4356   FIN d[10]=..........
   22:08:19.634429  e g         tcp     192.220.151.107.22       <?>        192.158.1.13.40983        12       2388   FIN d[10]=..........

Thx.

Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130129/824101df/attachment.html>