This question already has an answer here:

Or specifically, what can be done to detect or block the following (other than closing port 443)? If this is something that can or cannot be done based on the specific hardware used, please provide what this feature is called.

ssh -p 443 someuser@

marked as duplicate by schroeder Jun 5 '17 at 20:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • "deep packet inspection" can determine the protocol used and block - many advanced firewalls can do this (even if it is not 'very' deep inspection) – schroeder Jun 5 '17 at 19:56
  • @schroeder Thanks. I searched for a while, but did not see anything. I will look into deep packet inspection. Do you know if it is typically enforced? – user1032531 Jun 5 '17 at 20:52
  • Its basic feature of the firewall... to filter protocols on in/out interfaces. You can usually to chose if you filter, log or simply allow the traffic. I don't think there is specific name for it. Just TCP/UDP port filtering, protocol filtering, IP filtering... I am not sure if deep packet inspection applies in this case as it is not that deep ;) I know this term more related to higher layer protocols (such as application protocols like http). – Fis Jun 5 '17 at 23:24
  • Just to add - a wiki they call it just packet filter. Also, they are talking about "deep packet inspection". It is mainly used to detect if SSL traffic is passing 443 port only, not i.e. HTTP, SMTP, TELNET or whatever else. – Fis Jun 5 '17 at 23:33

If the IP is static you can block using a firewall port 443 to/from the IPs you want to block. Otherwise, you are looking for an IPS like Snort https://www.snort.org/ You can use it to configure a specific rule for blocking a signature or pattern of SSH traffic with whatever other parameters you might need.

  • 1
    firewalls can do it - no need for an added IPS – schroeder Jun 5 '17 at 20:03
  • You are right, most can. As long as they have some sort of deep packet inspection as you mention in your comment. I neglected to mention that. – Kotzu Jun 5 '17 at 20:21
  • Thanks, but as indicated, I am not inquiring about blocking ports, just protocols regardless of port. – user1032531 Jun 5 '17 at 20:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.