# Enable ssh detection? **URL:** \ **Category:** Zeek\ **Created:** [September 19, 2018, 8:56am UTC](https://community.zeek.org/t/enable-ssh-detection/5465 "2018-09-19T08:56:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![rahul\_rakesh](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@rahul\_rakesh](https://community.zeek.org/u/rahul_rakesh)\ **Post date:** [September 19, 2018, 8:56am UTC](https://community.zeek.org/t/enable-ssh-detection/5465/1 "2018-09-19T08:56:12Z")
Hi all, Given SSH example from Bro site is working fine ,when it is tested from the command line . I mean SSH events such as failed and success are generated and also log is created. But with out using ssh guess pcap file, when i do ssh thing between two systems, these events such as ssh\_auth\_fail and success are **NOT** generating. Can you tell How to solve this issue?. or How can i enable SSH detection? with regards ravi ---
**Author:** ![rahul\_rakesh](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@rahul\_rakesh](https://community.zeek.org/u/rahul_rakesh)\ **Post date:** [September 19, 2018, 12:24pm UTC](https://community.zeek.org/t/enable-ssh-detection/5465/2 "2018-09-19T12:24:00Z")
Hi PFA created pcap file after performing ssh logins. When it was used also , the ssh events are bot generating excepting version event. with regards ravi [newssh3aes.pcapng](https://community.zeek.org/uploads/short-url/1ggi7lZhVsNx3QaitrVlEKXdkF7.pcapng) (23.8 KB) ---
**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\ **Post date:** [September 19, 2018, 4:48pm UTC](https://community.zeek.org/t/enable-ssh-detection/5465/3 "2018-09-19T16:48:44Z")
Maybe attach the particular script you are using to make the determination that the events are not being generated, because I do see `ssh_auth_failed` get raised for that pcap. Or elaborate on what you expect to see versus what you are not seeing. Also note, as the docs say, failure/success determinations are made via packet size analysis and aren't generally guaranteed to be made if there's ambiguity. - Jon ---
**Author:** ![rahul\_rakesh](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@rahul\_rakesh](https://community.zeek.org/u/rahul_rakesh)\ **Post date:** [September 18, 2018, 8:06pm UTC](https://community.zeek.org/t/enable-ssh-detection/5465/4 "2018-09-18T20:06:25Z")
Hi Jon, Thank you for the ,response. In detail, I will explain the issue. I have created one bro script file “log-sample.bro”,in which three SSH events are defined with log stmts in simple way. It was also configured properly. After that, SSH client and server connection is made and it is successful. And then ,this whole connection is captured in “newssh3aes.pcapng”. Those two files mentioned are attached. When log-sample.bro is executed with newssh3aes.pcapng file, only ssh\_client\_version event is generated,but other two ssh events such as “ssh\_auth\_successful” and “ssh\_auth\_failed” are not generated. But if “log-sample.bro” is executed with “sshguess.pcap” provided by Bro for testing ,then all the above three events are generated. It seems the way bro made the SSH connection and my connection are different. Can you check and tell what mistake i am making either on code side,ssh configuration side? thank you ravi [log-sample.bro](https://community.zeek.org/uploads/short-url/yvn4LWN5f9f6mFQopJHMLcIzT1c.bro) (2.69 KB) [newssh3aes.pcapng](https://community.zeek.org/uploads/short-url/1ggi7lZhVsNx3QaitrVlEKXdkF7.pcapng) (23.8 KB) ---
**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\ **Post date:** [September 20, 2018, 5:15pm UTC](https://community.zeek.org/t/enable-ssh-detection/5465/5 "2018-09-20T17:15:24Z")
Thanks for explaining. One thing I noticed is that there's a difference in events generated between Bro 2.5.5 and 2.6-beta, with the later raising more events. The patch that results in the difference is at [1] in case you want to try to apply it or else I'd suggest trying out the beta version. - Jon [1] [https://github.com/bro/bro/commit/7e374f8c3f800b7fc2cdd4cf36dab753d3013754](https://github.com/bro/bro/commit/7e374f8c3f800b7fc2cdd4cf36dab753d3013754) ---
**Author:** ![rahul\_rakesh](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@rahul\_rakesh](https://community.zeek.org/u/rahul_rakesh)\ **Post date:** [September 24, 2018, 12:35pm UTC](https://community.zeek.org/t/enable-ssh-detection/5465/6 "2018-09-24T12:35:21Z")
Hi Jon, Thank you. Made the changes in Bro 2.5.3 as you suggested,it is working fine. One more thing, to execute the detect-MHR.bro file located in frameworks/files folder, I think some pdf is required to test it. So, Can you suggest me where can i get pdf file?. with regards ravi ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/enable-ssh-detection/5465/7 "2022-05-06T15:46:04Z")