Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I need some help identifying some Bad Protocol version identification errors from our server.
We're getting the following:
sshd[xxxx]: Bad protocol version identification '\200\342\001\003\001' from xx.xx.xx.xxxx
I don't know the format that '\200\342\001\003\001' is in, so it will be great if someone could help!
This is octal representation (base 8). During the initial steps of a SSH connection, the client and the server send each other the version(s) of the protocol they implement, as strings. These strings must follow a specific format.
Here, your server received from the client a "protocol version" string consisting of five bytes, of value 128, 226, 1, 3 and 1, in that order. This is not a "protocol version string" which makes sense. Probably, the client was not trying to do some SSH at all, but instead some other protocol.
A lot of virus try to propagate automatically that way: by trying known vulnerabilities of some protocols on random IP addresses and ports. So any publicly reachable server (like your SSH server) will get that kind of noise. Best thing to do is to ignore it altogether.
Adding a little to His Majestic Ursinity, it could be and I'd bet is (was) an SSL2-format ClientHello offering upgrade to TLS1.0. In 2013, before POODLE and then DROWN motivated people at last to eliminate outdated SSL3 and even SSL2 interfaces, it was fairly common for TLS clients to use SSL2-format because they had been configured or coded that way years earlier, maybe around 2005 when there actually were still a significant number of SSL2 servers -- and conversely TLS servers remained configured or coded to accept SSL2 format (even if not SSL2 protocol) in order to handle those clients without confusing errors and/or extra roundtrips. An SSH server, of course, doesn't understand either SSL2 or SSL3/TLS format.
