# Understanding Connection history for ssh. **URL:** \ **Category:** Zeek\ **Created:** [October 10, 2016, 5:37pm UTC](https://community.zeek.org/t/understanding-connection-history-for-ssh/4405 "2016-10-10T17:37:31Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![fatema\_bannatwala](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)\ **Post date:** [October 10, 2016, 5:37pm UTC](https://community.zeek.org/t/understanding-connection-history-for-ssh/4405/1 "2016-10-10T17:37:31Z")
Hi Bro team, I am trying to understand the ‘history’ field in conn.log for failed and successful ssh logins. Can we tell by looking into it whether the ssh connection was successful or not? For ex: We had a case today where bro-intel flagged an IP to be bad with 85% confidence rate, and when we saw the conn.log corresponding to that uid, we saw that, that IP was trying to ssh into a machine. Now the question is, can we tell by looking at the history - ShAdDa that the ssh was successful? intel.log entry 1476046696.592070 CXs7MT25xi6ykmT3o1 **77.242.90.96 50367 x.y.z.k 22** - - - 77.242.90.96 Intel::ADDR **SSH::SUCCESSFUL\_LOGIN** worker-3-4 [dataplane.org](http://dataplane.org/) 85.0 scanner conn.log entry 1476046725.508913 CXs7MT25xi6ykmT3o1 **77.242.90.96 50367** **x.y.z.k** **22** tcp ssh 10.623538 1383 1843 S1 F T 0 **ShAdDa** 15 2171 15 2631 (empty) ssh.log entry 1476046725.634328 CXs7MT25xi6ykmT3o1 **77.242.90.96** 50367 **x.y.z.k** 22 2 T INBOUND SSH-2.0-libssh2\_1.7.0 SSH-2.0-1.82 sshlib: WinSSHD 4.27 aes256-cbc hmac-sha1 none diffie-hellman-group1-sha1 ssh-dss b9:93:6a:61:8d:29:01:ec:aa:01:1f:0e:90:0a:7b:6e CZ 84 Prerov 49.453899 17.4524 Also, what does the conn history would look like in case of failed ssh login? Thanks for the help. Thanks, Fatema. ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 10, 2016, 6:11pm UTC](https://community.zeek.org/t/understanding-connection-history-for-ssh/4405/2 "2016-10-10T18:11:49Z")
Fatema, The T in your ssh.log is “auth\_success”, so yes…bro views this as a successful login. Also, that source IP is not so good…that IP is listed in [https://lists.blocklist.de/lists/ssh.txt](https://lists.blocklist.de/lists/ssh.txt). James ---
**Author:** ![Munroe\_Sollog](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@Munroe\_Sollog](https://community.zeek.org/u/Munroe_Sollog)\ **Post date:** [October 10, 2016, 7:42pm UTC](https://community.zeek.org/t/understanding-connection-history-for-ssh/4405/3 "2016-10-10T19:42:51Z")
> > Hi Bro team, > > > > I am trying to understand the 'history' field in conn.log for failed > > and successful ssh logins. > > Can we tell by looking into it whether the ssh connection was > > successful or not? > > > > For ex: We had a case today where bro-intel flagged an IP to be bad > > with 85% confidence rate, and when we saw the conn.log corresponding > > to that uid, we saw that, that IP was trying to ssh into a machine. > > Now the question is, can we tell by looking at the history - ShAdDa > > that the ssh was successful? > > > > intel.log entry > > 1476046696.592070 CXs7MT25xi6ykmT3o1 77.242.90.96 50367 > > X.Y.Z.K 22 - - - 77.242.90.96 Intel::ADDR SSH::SUCCESSFUL\_LOGIN > > worker-3-4 dataplane.org [1] 85.0 scanner > > > > conn.log entry > > 1476046725.508913 CXs7MT25xi6ykmT3o1 77.242.90.96 50367 > > X.Y.Z.K 22 tcp ssh 10.623538 1383 1843 S1 F T 0 > > SHADDA 15 2171 15 2631 (empty) > > > > ssh.log entry > > > > 1476046725.634328 CXs7MT25xi6ykmT3o1 77.242.90.96 50367 > > X.Y.Z.K 22 2 T INBOUND SSH-2.0-libssh2\_1.7.0 > > SSH-2.0-1.82 sshlib: WinSSHD 4.27 aes256-cbc hmac-sha1 > > none diffie-hellman-group1-sha1 ssh-dss > > b9:93:6a:61:8d:29:01:ec:aa:01:1f:0e:90:0a:7b:6e CZ 84 Prerov > >                                  49.453899 17.4524 > > > > Also, what does the conn history would look like in case of failed ssh > > login? > > > > Thanks for the help. > > > > Thanks, > > Fatema. > > Fatema, > The T in your ssh.log is "auth\_success", so yes...bro views this as a successful login. Also, that > source IP is not so good...that IP is listed in [https://lists.blocklist.de/lists/ssh.txt](https://lists.blocklist.de/lists/ssh.txt). > > James Be careful taking that column as fact. It seems like the success of an SSH connection is purely based on the size of the response. A large SSH banner can cause a false positive. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/understanding-connection-history-for-ssh/4405/4 "2022-05-06T15:44:08Z")