I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected for a long time but I do not remember how. I looked at Snort, even posted here about it, but I could not find a rule that would allow me to watch a ssh session over any amount of time and then only alert if it hit a specific time limit.

Can someone point me in the right direction/technology for this?

Thank you,

  • If I understand correctly, you are in the position of a passive network "attacker", i.e. you are trying to detect long lived ssh sessions by monitoring the network. Is this correct? – Daniel Szpisjak Aug 6 '17 at 21:31
  • That is correct, so not from the host but from the watching the network and trying to detect any long lived sessions going to any host. – Brett Littrell Aug 7 '17 at 3:12
  • Are you explicitly trying to implement this via passive monitoring or is a server-side solution viable? – symcbean Oct 6 '17 at 12:09

I could not find an out-of-the-box solution for this, however I think this can be done by scripting a little. Here are my thoughts.

Set up Snort to alert on TCP handshakes to SSH target ports. Have it log these alerts to a file. Also set up traffic alerts to/from SSH ports. Write these alerts to a file as well.

Then, create a script which correlates these events and alerts if a connection is alive for too long.

A simple state machine should do the job. If the handshake alert is encounter save the from/to ip to some kind of storage (can be memory) as well as the ports and the time of the alert. Have a last seen date saved as well and update that as you see traffic between the two hosts. Check if the difference between last seen and connection established is greater than your preference.


Depends on what you want to do, but we can start with who -a.

This will show you who is logged in, when the session started, and will even give you old if it's an old one. For ssh, you'll probably want to focus on pty (pseudo terminal for remote logins) instead of tty (actual terminals, for physical logins).

To get the dates, you can use:

dates=`who -a | grep root | awk '{ print $4 }'`

You can then compare those dates to an arbitrary limit you set to find suspect / old / dead logins.

Of course, the above gives you all the root logins. If you want all remote pts logins, you can use:

dates=`who -a | grep pts | awk '{ print $4 }'`

But, then you have to filter out non-user account logins. It's simplier to grep on a username, but without knowing to what end you need to use this for, it's hard to tailor the answer much more.

  • Thank you Dr, I should be been a bit clearer. I am looking on the network not on a specific host, I want to find it for any long lived sessions going to any hosts, even ones that I do not have local control over. That is good information though and thank you for offering it. – Brett Littrell Aug 7 '17 at 3:16
  • Not sure you can (at least not sure if you can do it easily). It might be possible to sniff out SSH conversations amongst the network traffic, but I am not sure how useful it would be. Looking at a wireshark capture, I can see SSH, but the session values are encrypted of course. So, you can see that there is an SSH session, but no meta-data about age. Even still, a network switch prevents us from sniffing passively. You'd have to do it at the firewall. So, ingress / egress sessions could be logged at the firewall, and then you could see their age. Not sure how reliable it would be though. – DrDamnit Aug 7 '17 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.