# ssh connetions. **URL:** \ **Category:** Zeek\ **Created:** [March 17, 2016, 4:27pm UTC](https://community.zeek.org/t/ssh-connetions/4056 "2016-03-17T16:27:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Tim\_Desrochers](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@Tim\_Desrochers](https://community.zeek.org/u/Tim_Desrochers)\ **Post date:** [March 17, 2016, 4:27pm UTC](https://community.zeek.org/t/ssh-connetions/4056/1 "2016-03-17T16:27:35Z")
Is it possible for someone to establish an SSH session but the bro log not to show “auth\_success” as true. Thanks Tim ---
**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\ **Post date:** [March 17, 2016, 5:40pm UTC](https://community.zeek.org/t/ssh-connetions/4056/2 "2016-03-17T17:40:22Z")
Yes. A good example of this is if SSH compression is enabled. I would hope that auth\_success is set to "-" and not set to the incorrect T or F state, but it's possible that there's some server/client combination out there that's throwing off the detection. If you are seeing such cases, please send a PCAP and I can look at improving the detection.   --Vlad Tim Desrochers \<[tgdesrochers@gmail.com](mailto:tgdesrochers@gmail.com)\> writes: ---
**Author:** ![Tim\_Desrochers](https://avatars.discourse-cdn.com/v4/letter/t/e19b73/32.png) [@Tim\_Desrochers](https://community.zeek.org/u/Tim_Desrochers)\ **Post date:** [March 17, 2016, 5:43pm UTC](https://community.zeek.org/t/ssh-connetions/4056/3 "2016-03-17T17:43:28Z")
What I am seeing is “-“ but on successful connects from internal host to internal host I am seeing “success” I am in the process of examining pcap and auth logs on the server at this moment to determine success or failure ---
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [March 17, 2016, 5:55pm UTC](https://community.zeek.org/t/ssh-connetions/4056/4 "2016-03-17T17:55:40Z")
Similarly I’ve seen SSH sessions not identified when SSH is multiplexed with other protocols on the same port; e.g. SSH and HTTP on port 80. Wish I had more time to help with detecting cases like this. [https://github.com/stealth/sshttp](https://github.com/stealth/sshttp) ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [March 17, 2016, 6:03pm UTC](https://community.zeek.org/t/ssh-connetions/4056/5 "2016-03-17T18:03:22Z")
I've been working on that as part of [https://bro-tracker.atlassian.net/browse/BIT-1521](https://bro-tracker.atlassian.net/browse/BIT-1521) There's a bug in the current known services policy that causes multiple protocols on the same port to not be logged to known\_services.log, but they should still show up in conn.log as the proper service. There is a slightly different but related issue in that if you send an http request to an ssh server or an ssh client banner to an http server, bro won't attach both analyzers to the connection. So, you'll get either an http log or an ssh log, but not both. ---
**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\ **Post date:** [March 17, 2016, 6:14pm UTC](https://community.zeek.org/t/ssh-connetions/4056/6 "2016-03-17T18:14:18Z")
Nice, thanks for the explanation. I sometimes see this when working cases in ELSA as I always look for BRO\_SSH entries. It’s the second case that I believe I'm seeing and I think Seth explained it to me a couple months back as well. Suricata picks them up, so it hasn't been a high priority for me to delve into the Bro analyzers. That and I haven't done any real C++ programming in a very long time though I wish I could. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/ssh-connetions/4056/7 "2022-05-06T15:43:29Z")
Closed on May 6, 2022, 3:43pm UTC