Which payload data would be difficult for IDS/IPS signatures to analyze?
SSH encrypts its session payload after connection setup, preventing signature-based IDS/IPS systems from examining most of the content for matching patterns. Cisco documents that its SSH inspection engine can examine only setup fields because the remainder of an SSH session is encrypted.
Community Discussion