Monitor SSH traffic

Question

Hi Folks,

I was monitoring my SSH port with tcpdump and have had a lot of activity as expected. When I look at the traffic I get the above image. What does it mean?

Thanks

Answer 1

That is the SSH2 key exchange. The following is a quick and dirty run down of SSH.

When the SSH tunnel is established the client and server perform a Diffie Hellman (DH) exchange. This is to establish a shared secret between the client and server in order to generate the session keys needed for the encrypted tunnel.

The way SSH does this by first establishing the algorithms. Each side first sends their SSH version (which I don't see in your capture for some reason), and all of the algorithm combinations each supports. The server chooses the first one that matches in both lists. Then the DH parameters are sent, hashed value H (which hashes 7-12 pieces of data), and the signature of H to ensure it hasn't been tampered with. This is most likely the binary data you see in the picture.

I'm skimming over the details, but essentially after all this is said and done there is a value K that only both sides can generate. Using whichever hashing algorithm agreed upon the session ID, H, and K are all used to generate the session keys.

TimC is correct that looking at the data in Wireshark will tell you a lot more. Each of those pieces will be parsed out with nice easy to read labels. As long as the default SSH port (22) is used. I've also found that Wireshark sometimes does not associate some TCP packets with the SSH session, and those packets are not properly parsed. This doesn't mean the data did not reach its destination; it just means that Wireshark could not properly interpret the data. Depends on the version of Wireshark you're using.

Here's a basic introduction to SSH versions, with some extra linkage.

Answer 2

It looks like it could be binary data, or it could even be the encrypted data that is being sent across.

If you were to look at it in Wireshark then it would make it more obvious as it shows you each part of the network frame and you would be able to see where abouts in the packet that data is.