sshow8
Ssh traffic analysis tool
Usage
sshow [-d]
[{-i
interface | -p
pcapfile}]
[expression]
Overview
sshow analyzes encrypted SSH-1 and SSH-2 traffic, identifying authentication attempts, the lengths of passwords entered in interactive sessions, and command line lengths.
The following advisory describes the attacks implemented by sshow in detail:
http://www.openwall.com/advisories/OW-003-ssh-traffic-analysis.txt
Options
-
-d -
Enable verbose debugging output.
-
-i interface -
Specify the interface to listen on.
-
-p pcapfile -
Process packets from the specified PCAP capture file instead of the network.
- expression
-
Specify a tcpdump(8) filter expression to select traffic to sniff.
History
- Arch Linux 2026-11-01 to Debian 4.0 (Etch): the text shown here
- Debian 3.1 (Sarge)
-p since Debian 4.0 (Etch).