Add signature: SSH "Connection reset"

Create issue
Issue #23 resolved
Former user created an issue

I've been getting some probes that don't quite match the existing ruleset. Instead of closing the connection, it resets.

sshd[12345]: Connection reset by $IP [preauth]

I've attached a patch against 1.6.3 that should handle this, but I haven't had any more scans to verify it works properly.

Comments (2)

  1. Log in to comment