anti d3321324eb feat(sniffer): capture SSH client banner from TCP stream ...

Parse RFC 4253 §4.2 identification strings from the first attacker→decky
data segment on TCP/22; emit ssh_client_banner syslog events and bus
fan-out. Profiler's sniffer_rollup dedupes observed banners into a new
AttackerBehavior.ssh_client_banners JSON column.

Closes gap #3 from SIGNAL_CAPTURE_AUDIT.md.

2026-04-22 21:37:01 -04:00

4.3 KiB

Raw Blame History

View Raw