Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need some help identifying some Bad Protocol version identification errors from our server.

We're getting the following:

sshd[xxxx]: Bad protocol version identification '\200\342\001\003\001' from xx.xx.xx.xxxx

I don't know the format that '\200\342\001\003\001' is in, so it will be great if someone could help!

share|improve this question
up vote 11 down vote accepted

This is octal representation (base 8). During the initial steps of a SSH connection, the client and the server send each other the version(s) of the protocol they implement, as strings. These strings must follow a specific format.

Here, your server received from the client a "protocol version" string consisting of five bytes, of value 128, 226, 1, 3 and 1, in that order. This is not a "protocol version string" which makes sense. Probably, the client was not trying to do some SSH at all, but instead some other protocol.

A lot of virus try to propagate automatically that way: by trying known vulnerabilities of some protocols on random IP addresses and ports. So any publicly reachable server (like your SSH server) will get that kind of noise. Best thing to do is to ignore it altogether.

share|improve this answer
    
Sorry, I thought I responded to this a while ago. Thanks for the info, I've written up the report with help from this post – Mehcs85 Feb 13 '13 at 10:32

Adding a little to His Majestic Ursinity, it could be and I'd bet is (was) an SSL2-format ClientHello offering upgrade to TLS1.0. In 2013, before POODLE and then DROWN motivated people at last to eliminate outdated SSL3 and even SSL2 interfaces, it was fairly common for TLS clients to use SSL2-format because they had been configured or coded that way years earlier, maybe around 2005 when there actually were still a significant number of SSL2 servers -- and conversely TLS servers remained configured or coded to accept SSL2 format (even if not SSL2 protocol) in order to handle those clients without confusing errors and/or extra roundtrips. An SSH server, of course, doesn't understand either SSL2 or SSL3/TLS format.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.