Unless you've added a new custom attack class in your
classification.config file with the name
attempted0recon, there isn't any such class in Snort by default. There is however a class named
You have also not set any additional filters for which the message "SSH retransmission detected" should be reported, so your example would read as:
Alert with class
attempted0recon and message 'SSH retransmission
detected' any inbound TCP connection to
22 originating from any remote address and port.
I didn't write it in exact order, as that would make it utterly unreadable, but the general Snort rules form is:
action proto src_ip src_port direction dst_ip dst_port (options)
Your rule could thus read like this:
alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected";
for your rule in the example you provided. Since the other (first packet) rule can't depend on any payload contents (as I don't see any in your printout), you could for example use dsize keyword in the options part to identify them by their size and/or other non-payload detections:
alert tcp any any -> <destinationAddress> 22 (msg:"SSH key exchange";
Obviously, you could adopt these to suit your needs better and they are just examples.