Timeline for Snort "Protocol mismatch" from SSH preprocessor
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 5, 2018 at 15:44 | comment | added | mikebabcock | fwiw I have the same problem, and am fighting with snort to shut up about a non-existant mismatch as well. | |
| S Apr 20, 2017 at 13:53 | history | suggested | CommunityBot | CC BY-SA 3.0 |
The option listed is incorrect, see source
|
| Apr 20, 2017 at 13:52 | review | Suggested edits | |||
| S Apr 20, 2017 at 13:53 | |||||
| Feb 24, 2016 at 21:27 | comment | added | JDS | Nope, there are zero "Bad protocol" errors in any logs anywhere, except the Snort "Protocol mismatch" errors. But that seems legit -- the version of OpenSSH is the same everywhere in our env. The only thing that seems bogus here is Snort's noisiness. Thanks | |
| Feb 24, 2016 at 21:02 | comment | added | Jakuje | I don't mean your successful authentication log (auth.log is also handled by syslog). I mean the real reason why your Snort yells. Openssh should log these bads regardless configuration. Last thing would be catching packets in tcpdump or something. | |
| Feb 24, 2016 at 20:59 | history | edited | Jakuje | CC BY-SA 3.0 |
added 141 characters in body
|
| Feb 24, 2016 at 20:52 | comment | added | JDS | I DO have logs, it is just that there was no correlating event in the syslog. Ubuntu doesn't put SSH auth events in syslog anyway, it puts them in auth.log, which I mentioned. Is there something I should change in my syslog config that captures SSH events? | |
| Feb 24, 2016 at 20:02 | comment | added | Jakuje | If you don't have any logs, then it is more like fortune telling. If it yells about every packet, then it does not make much sense. BTW how do you implement the jumpbox? It might be the issue? | |
| Feb 24, 2016 at 19:50 | comment | added | JDS | Thanks for replying! I read that seclist link before I posted here. The link doesn't make any sense with respect to our Snort reporting this error, because every box in our env is an Ubuntu 14.04 box with SSH updated to the same version. I looked in syslog and there is nothing; however in auth.log there is one indicator which is a line stating that I successfully SSH'ed in at that time. But why would one SSH session spawn 1300 Snort alerts? | |
| Feb 24, 2016 at 19:22 | history | answered | Jakuje | CC BY-SA 3.0 |