# Bro doesn't detect SSH version in local network **URL:** \ **Category:** Zeek\ **Created:** [June 21, 2017, 12:45pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911 "2017-06-21T12:45:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Anton\_Egorov](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Anton\_Egorov](https://community.zeek.org/u/Anton_Egorov)\ **Post date:** [June 21, 2017, 12:45pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/1 "2017-06-21T12:45:32Z")
Hi, Bro somehow doesn’t detect the SSH client version when listening on a local network interface. The machine with installed Bro has two network interfaces. One is in the company common network and the other is in the small test network. Small network has address in a [192.168.0.0/16](http://192.168.0.0/16) space. Other machines in the small network has the two interfaces for intranet and test network as well. When ssh connection is established from test machine and Bro is listening on eth0 interface the ssh client version gets detected. But if ssh connection targets the eth1 interface which Bro is listening nothing gets detected. Here are the interfaces on machine with installed bro: # ifconfig eth0 Link encap:Ethernet HWaddr 00:50:56:99:76:5f inet addr:10.31.10.190 Bcast:10.31.10.255 Mask:255.255.255.0 UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:346628470 errors:0 dropped:1417 overruns:0 frame:0 TX packets:327889 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:104910129783 (97.7 GiB) TX bytes:77220087 (73.6 MiB) eth1 Link encap:Ethernet HWaddr 00:50:56:99:74:81 inet addr:192.168.99.90 Bcast:192.168.99.255 Mask:255.255.255.0 UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:1648090595 errors:0 dropped:20 overruns:0 frame:0 TX packets:645 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:98885922776 (92.0 GiB) TX bytes:93928 (91.7 KiB) Bro is started like that # bro -i eth0 os-app-detect.bro local or for a local interface # bro -i eth1 os-app-detect.bro local The output that shows in the first case is: OpenSSH OpenSSH\_6.0p1 Debian-4+deb7u3 The connections from a test machine runs like that On eth0 interface (Bro detects it) # ssh [root@10.31.10.190](mailto:root@10.31.10.190) On eht1 interface (Bro doesn’t detect it) # ssh [root@192.168.99.90](mailto:root@192.168.99.90) The .bro script for printing SSH client version: ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [June 21, 2017, 2:21pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/2 "2017-06-21T14:21:52Z")
see [https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums](https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums) ---
**Author:** ![Anton\_Egorov](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Anton\_Egorov](https://community.zeek.org/u/Anton_Egorov)\ **Post date:** [June 21, 2017, 2:37pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/3 "2017-06-21T14:37:12Z")
The offloading is disabled on both NIC’s and the -C option also doesn’t do the trick. While reading pcap of a saved ssh traffic bro outputs a warning: # /usr/local/bro/bin/bro -C -r /root/eth1-ssh.cap /usr/local/bro/share/bro/pluton/os-app-detect.bro local UNKNOWN 1497975118.771257 warning: Stream SOrfileNrXm8iGmlR6 is already queued for removal. Ignoring remove. while on a pcap from the other interface: # /usr/local/bro/bin/bro -C -r /root/eth0-ssh.cap /usr/local/bro/share/bro/pluton/os-app-detect.bro local UNKNOWN OpenSSH OpenSSH\_6.0p1 Debian-4+deb7u3 Thank you ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [June 21, 2017, 2:44pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/4 "2017-06-21T14:44:58Z")
What does the full conn.log entry show for the SSH connection in these two cases? Can you upgrade bro to 2.5 or the 2.5.1 beta? 2.4.1 is almost a year old at this point. ---
**Author:** ![Anton\_Egorov](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Anton\_Egorov](https://community.zeek.org/u/Anton_Egorov)\ **Post date:** [June 22, 2017, 10:02am UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/5 "2017-06-22T10:02:41Z")
Connection entries differs only in ` local_orig local_resp` fields. What is the meaning of these connection parameters? ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [June 22, 2017, 1:44pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/6 "2017-06-22T13:44:48Z")
Ah, so you have 2 separate problems here. Your first problem was that bro was only seeing half of the traffic. Note, this does not have anything to do with wether or not you ran an ls command. The TCP 3 way handshake and the ssh negotiation would include traffic from both sides. Your latest conn log entry shows a proper record with packets from both directions of the connection, so whatever the issue you were having with that has been resolved. Your second problem is that you are using the Software::log\_software event. By default this will only log software seen on local ip addresses. For a bro installation that is using broctl this is controlled by /usr/local/bro/etc/networks.cfg. If you're normally using broctl just ensure that 192.168.99.0/24 and 10.31.10.0/24 (or whatever larger block you are using) is present in that file. If you're not using broctl just use another script that includes redef Site::local\_nets = {   10.0.0.0/8, # Private IP space   192.168.0.0/16, # Private IP space }; ---
**Author:** ![Anton\_Egorov](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Anton\_Egorov](https://community.zeek.org/u/Anton_Egorov)\ **Post date:** [June 22, 2017, 3:39pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/7 "2017-06-22T15:39:53Z")
Thank you very much. After setting proper local IP space it is working. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/bro-doesnt-detect-ssh-version-in-local-network/4911/8 "2022-05-06T15:45:04Z")