Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know routing information is always sent in the clear (oversimplification, but bear with me) so in a scenario where there exists an SSH tunnel between a client and a server using non-standard ports, and the tunnel is encrypted using a secure key exchange with shared secret, is it possible to discern that the traffic itself is SSH? (EG: Is the layer 3 header information in the clear?)

Also, are there other ways to know that this traffic is SSH?

Thanks.

TL;DR: How can you determine an SSH packet is SSH?

share|improve this question

3 Answers 3

The traffic itself is encrypted by SSL, so it's hard to see the difference compared to other SSL protocols (HTTPS. OpenVPN, etc.).

But, if the attacker captures the whole communication, it also gets the handshake, from which he can clearly see it's SSH. He also sees the ssh clients and hosts IP (tunnel endpoints) and ports used by them. He cannot see the traffic through the tunnel.

SSH handshake

share|improve this answer
    
Thank you so much. You've made my day! =D –  Andrew Dec 5 '12 at 4:25
    
What application is that a screenshot of? –  Andrew Dec 5 '12 at 4:25
    
That is wireshark (wireshark.org) - it can capture and/or analyze network traffic –  mulaz Dec 5 '12 at 10:53

If the attacker has access to the entire TCP session, they will have sufficient clues to know that the transport protocol is ssh. Try to telnet to port 22 on a server you know is running ssh on a standard port to see how.

If the attacker does traffic analysis, he or she will quite possibly be able to distinguish ssh terminal traffic from ssh port forwarding traffic (though not able to identify the contents directly). Basically, typing does not look like downloading HTML, downloading, or transferring data at any speed / with little latency.

If the attacker has access to all of the network traffic for one of the endpoints, he or she will quite possibly be able to identify what specific fraction of the traffic passing through that endpoint also passed through the tunnel... but you've already lost a lot by that point; not much privacy to preserve.

There isn't really that much information in the clear though. I doubt there is a serious risk here, but without knowing your concerns, it is hard to address them.

share|improve this answer

My understanding is that once the tunnel is established, the traffic above layer 4 will be gibberish. So if you're on a non-standard port, it would be hard, if not impossible to discern between any encrypted traffic. I.e. you wouldn't be able to tell between SSH, SSL, or other encryption methods. I'm happy to be corrected if that's wrong though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.