# Detecting https-tunneled ssh traffic

**URL:** <https://forum.suricata.io/t/detecting-https-tunneled-ssh-traffic/495>\
**Category:** Rules\
**Tags:** pfsense\
**Created:** [August 13, 2020, 11:51am UTC](https://forum.suricata.io/t/detecting-https-tunneled-ssh-traffic/495 "2020-08-13T11:51:47Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![shyang](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@shyang](https://forum.suricata.io/u/shyang)\
**Post date:** [August 5, 2021, 4:07am UTC](https://forum.suricata.io/t/detecting-https-tunneled-ssh-traffic/495/4 "2021-08-05T04:07:49Z")

</div>

I have the same issue of ‘dsize’.

- [ssh dsize issue](https://forum.suricata.io/t/can-i-use-dsize-in-rules-when-ssh-is-enabled/1588)

from suricata guide,

- [Don’t Cross The Streams](https://suricata.readthedocs.io/en/suricata-6.0.3/rules/differences-from-snort.html?highlight=dsize#don-t-cross-the-streams)

---

_[View the full topic](https://forum.suricata.io/t/detecting-https-tunneled-ssh-traffic/495)._