Hello Suricata community, I am trying to write a rule that detects ssh traffic that is tunneled in https traffic with the program stunnel. I’ve found out that the datalength that is send from the ssh-client to the ssh-server is always the same in every transmitted https-packet, so I will count the …

Detecting https-tunneled ssh traffic

shyang (seungho yang) August 5, 2021, 4:07am 4

I have the same issue of ‘dsize’.

from suricata guide,