Unless you've added a new custom attack class in your classification.config
file with the name attempted0recon
, there isn't any such class in Snort by default. There is however a class named attempted-recon
.
You have also not set any additional filters for which the message "SSH retransmission detected" should be reported, so your example would read as:
Alert with class attempted0recon
and message 'SSH retransmission
detected' any inbound TCP connection to <destinationAddress>
port
22 originating from any remote address and port.
I didn't write it in exact order, as that would make it utterly unreadable, but the general Snort rules form is:
action proto src_ip src_port direction dst_ip dst_port (options)
Your rule could thus read like this:
alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected";
content:"TCP Retransmission";
nocase;
classtype:attempted-recon;)
for your rule in the example you provided. Since the other (first packet) rule can't depend on any payload contents (as I don't see any in your printout), you could for example use dsize keyword in the options part to identify them by their size and/or other non-payload detections:
alert tcp any any -> <destinationAddress> 22 (msg:"SSH key exchange";
dsize: <518;
classtype:tcp-connection;)
Obviously, you could adopt these to suit your needs better and they are just examples.