So now that we have covered FTP sessions and how they can
be analyzed for brute force attacks, let's move on and talk about SSH sessions.
Unlike FTP, SSH does utilize encryption,
and because of this,
makes our job of determining whether an attack is occurring much harder.
The reason for this is that we are not able to access the same
command level knowledge that we can with FTP,
and because of this, a more creative solution needs to be utilized.
If we take a capture of known good and bad SSH logins and
map these sessions out with Wireshark, we will see a pattern.
In the figure shown,
there are a number of different sessions with unsuccessful SSH logins.
When we look at the number of bytes that have been transferred,
we will see a pattern that we are looking for.
Almost all of the sessions have a byte count that
is between 6700 and 7000 bytes.
Now this by itself doesn't mean much unless we compare it with the same view,
but with successful sessions.
For this figure shown, instead of showing failed SSH login attempts,
we're showing a capture of four different successful SSH logins.
As you can see,
each of these sessions has a total byte count of around 14,000 bytes.
It should also be noted that with these successful logins,
no other commands were run, except to log in and exit the session.
So what do you think we can do with this information?
Since there is such an obvious difference in the number of bytes
exchange between a failed and successful SSH login attempt,
we can use this information to determine whether multiple failed attempts
are occurring while also screening out successful ones.
So for our demonstration,
we will be taking this information and using it to design a mechanism to
track the number of bytes exchanged per session and flag all sessions inside
a specific threshold as potential failed attempts.
And so now with this reviewed,
let's move into the next section where we will move into the demonstration
environment again and show how we can implement this analysis.