Detect management protocols in your network

There are lots of IDS/IPS solutions across the network. Many of them a capable to detect SSH or other management protocols. Today I'm gonna tell you how they usually do this and what techniques are used.

And again, we'll use our favourite scheme:

You have configured the access lists or firewall on router R1, but still, you suspect that someone is using SSH to access their home server/VPS/etc. Of course they don't use TCP/22, but TCP/443. How could you determine, that it is SSH?

Of course you could telnet to remote host and see if the banner comes up:

Escape character is '^]'.
SSH-2.0-OpenSSH_6.0p1 Debian-4

Not our method, right?

The thing

During SSH session each keystroke causes four TCP segments to appear on the network. So, you want to execute ls command on the remote server, it looks like this for letter l:

In tcpdump you usually see just three segments, 'cause the reply from the server is concatenated into one PSH, ACK. But I guess you get the idea.
Also, these packets are very small.

Why is that so? Why not to send the whole command?

The thing is, that there might be the commands on the server that are only one character long. SSH chooses not to try to understand what sequence of characters constitute a command and simply sends across characters as they are typed.

Action

So how can I detect it?

• As I've already said - IPS/IDS solutions. Almost all of them are signature-based and are pretty flexible in configuration. Suricata and Snort, the most famous open-source solutions, are capable of detecting almost anything.
• Analyse traffic dumps. You may do it manually or just use Scapy :)
• Use flows - netflows, sflows, etc.. Connecting you flow sources to some SIEM system will give you the better knowledge of your network.