Refactored detection logic to include ports and a confidence score

protocol/detect_ssh.go

@@ -14,10 +14,14 @@ func init() {
 	Register(Both, "", detectSSH)
 }
 
-func detectSSH(dir Direction, data []byte) *Protocol {
+func detectSSH(dir Direction, data []byte, srcPort, dstPort int) (proto *Protocol, confidence float64) {
 	// The data must be at least as long as the prefix itself.
 	if len(data) < len(ssh20Prefix) {
-		return nil
+		return nil, 0
+	}
+
+	if dstPort == 22 || dstPort == 2200 || dstPort == 2222 {
+		confidence = .1
 	}
 
 	// The protocol allows for pre-banner text, so we have to check all lines.
@@ -32,7 +36,7 @@ func detectSSH(dir Direction, data []byte) *Protocol {
 					Patch: -1,
 					Extra: string(line[len(ssh20Prefix):]),
 				},
-			}
+			}, confidence + 0.75
 		}
 		if bytes.HasPrefix(line, []byte(ssh199Prefix)) {
 			return &Protocol{
@@ -43,9 +47,9 @@ func detectSSH(dir Direction, data []byte) *Protocol {
 					Patch: -1,
 					Extra: string(line[len(ssh20Prefix):]),
 				},
-			}
+			}, confidence + 0.75
 		}
 	}
 
-	return nil
+	return nil, 0
 }