Wireshark · Display Filter Reference: SSH Protocol

Field name	Description	Type	Versions
ssh.auth_failure_cont_list	Authentications that can continue list	Character string	4.0.0 to 4.4.2
ssh.auth_failure_cont_list_length	Authentications that can continue list len	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.blob.ssh-rsa.e	ssh-rsa public exponent (e)	Byte sequence	4.0.0 to 4.4.2
ssh.blob.ssh-rsa.n	ssh-rsa modulus (n)	Byte sequence	4.0.0 to 4.4.2
ssh.channel_data_length	Data length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.channel_number.error	Coud not find channel	Label	4.4.0 to 4.4.2
ssh.channel_request_name	Channel request name	Character string	4.4.0 to 4.4.2
ssh.channel_request_name_length	Channel request name length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.channel_request_want_reply	Channel request want reply	Unsigned integer (8 bits)	4.0.0 to 4.4.2
ssh.channel_window_adjust	Bytes to add	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.compression_algorithms_client_to_server	compression_algorithms_client_to_server string	Character string	1.0.0 to 4.4.2
ssh.compression_algorithms_client_to_server_length	compression_algorithms_client_to_server length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.compression_algorithms_server_to_client	compression_algorithms_server_to_client string	Character string	1.0.0 to 4.4.2
ssh.compression_algorithms_server_to_client_length	compression_algorithms_server_to_client length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.connection_initial_window_size	Initial window size	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.connection_recipient_channel	Recipient channel	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.connection_sender_channel	Sender channel	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.connection_type_name	Channel type name	Character string	4.0.0 to 4.4.2
ssh.connection_type_name_length	Channel type name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.cookie	Cookie	Byte sequence	1.0.0 to 4.4.2
ssh.debug_always_display	Always Display	Boolean	4.0.0 to 4.4.2
ssh.debug_name	Debug message	Character string	4.0.0 to 4.4.2
ssh.debug_name_length	Debug message length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.dh.e	DH client e	Byte sequence	1.2.0 to 4.4.2
ssh.dh.f	DH server f	Byte sequence	1.2.0 to 4.4.2
ssh.dh.g	DH base (G)	Byte sequence	1.2.0 to 2.2.17
ssh.dh.p	DH modulus (P)	Byte sequence	1.2.0 to 2.2.17
ssh.dh_gex.g	DH GEX base (G)	Byte sequence	2.4.0 to 4.4.2
ssh.dh_gex.max	DH GEX Max	Unsigned integer (32 bits)	1.2.0 to 4.4.2
ssh.dh_gex.min	DH GEX Min	Unsigned integer (32 bits)	1.2.0 to 4.4.2
ssh.dh_gex.nbits	DH GEX Number of Bits	Unsigned integer (32 bits)	1.2.0 to 4.4.2
ssh.dh_gex.p	DH GEX modulus (P)	Byte sequence	2.4.0 to 4.4.2
ssh.direction	Direction	Boolean	3.2.0 to 4.4.2
ssh.disconnect_description	Disconnect description	Character string	4.0.0 to 4.4.2
ssh.disconnect_description_length	Disconnect description length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.disconnect_reason	Disconnect reason	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.ecdh.q_c	ECDH client's ephemeral public key (Q_C)	Byte sequence	2.4.0 to 4.4.2
ssh.ecdh.q_c_length	ECDH client's ephemeral public key length	Unsigned integer (32 bits)	2.4.0 to 4.4.2
ssh.ecdh.q_s	ECDH server's ephemeral public key (Q_S)	Byte sequence	2.4.0 to 4.4.2
ssh.ecdh.q_s_length	ECDH server's ephemeral public key length	Unsigned integer (32 bits)	2.4.0 to 4.4.2
ssh.encrypted_packet	Encrypted Packet	Byte sequence	1.0.0 to 4.4.2
ssh.encryption_algorithms_client_to_server	encryption_algorithms_client_to_server string	Character string	1.0.0 to 4.4.2
ssh.encryption_algorithms_client_to_server_length	encryption_algorithms_client_to_server length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.encryption_algorithms_server_to_client	encryption_algorithms_server_to_client string	Character string	1.0.0 to 4.4.2
ssh.encryption_algorithms_server_to_client_length	encryption_algorithms_server_to_client length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.exit_status	Exit status	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.extension.count	Extension count	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.extension.delay_compression.compression_algorithms_client_to_server	Compression algorithms (client to server)	Character string	4.4.0 to 4.4.2
ssh.extension.delay_compression.compression_algorithms_client_to_server_length	Compression algorithms (client to server) length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.extension.delay_compression.compression_algorithms_server_to_client	Compression algorithms (server to client)	Character string	4.4.0 to 4.4.2
ssh.extension.delay_compression.compression_algorithms_server_to_client_length	Compression algorithms (server to client) length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.extension.elevation.value	Elevation flag	Character string	4.4.0 to 4.4.2
ssh.extension.name	Extension name	Character string	4.4.0 to 4.4.2
ssh.extension.name_length	Extension name length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.extension.no_flow_control.value	No flow control flag	Character string	4.4.0 to 4.4.2
ssh.extension.prop_publickey_algorithms.algorithms	Public key algorithms	Character string	4.4.0 to 4.4.2
ssh.extension.server_sig_algs.algorithms	Accepted signature algorithms	Character string	4.4.0 to 4.4.2
ssh.extension.value	Extension value	Byte sequence	4.4.0 to 4.4.2
ssh.extension.value_length	Extension value length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.first_kex_packet_follows	First KEX Packet Follows	Unsigned integer (8 bits)	2.4.0 to 4.4.2
ssh.global_request_hostkeys	Host keys array length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.global_request_name	Global request name	Character string	4.0.0 to 4.4.2
ssh.global_request_name_length	Global request name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.global_request_want_reply	Global request want reply	Unsigned integer (8 bits)	4.0.0 to 4.4.2
ssh.host_key.data	Host key data	Byte sequence	2.2.0 to 4.4.2
ssh.host_key.dsa.g	DSA subgroup generator (g)	Byte sequence	2.4.0 to 4.4.2
ssh.host_key.dsa.p	DSA prime modulus (p)	Byte sequence	2.4.0 to 4.4.2
ssh.host_key.dsa.q	DSA prime divisor (q)	Byte sequence	2.4.0 to 4.4.2
ssh.host_key.dsa.y	DSA public key (y)	Byte sequence	2.4.0 to 4.4.2
ssh.host_key.ecdsa.id	ECDSA elliptic curve identifier	Character string	2.4.0 to 4.4.2
ssh.host_key.ecdsa.id_length	ECDSA elliptic curve identifier length	Unsigned integer (32 bits)	2.4.0 to 4.4.2
ssh.host_key.ecdsa.q	ECDSA public key (Q)	Byte sequence	2.4.0 to 4.4.2
ssh.host_key.ecdsa.q_length	ECDSA public key length	Unsigned integer (32 bits)	2.4.0 to 4.4.2
ssh.host_key.eddsa.key	EdDSA public key	Byte sequence	3.4.0 to 4.4.2
ssh.host_key.eddsa.key_length	EdDSA public key length	Unsigned integer (32 bits)	3.4.0 to 4.4.2
ssh.host_key.length	Host key length	Unsigned integer (32 bits)	2.2.0 to 4.4.2
ssh.host_key.rsa.e	RSA public exponent (e)	Byte sequence	2.2.0 to 4.4.2
ssh.host_key.rsa.n	RSA modulus (N)	Byte sequence	2.2.0 to 4.4.2
ssh.host_key.type	Host key type	Character string	2.2.0 to 4.4.2
ssh.host_key.type_length	Host key type length	Unsigned integer (32 bits)	3.0.0 to 4.4.2
ssh.host_sig.data	Host signature data	Byte sequence	4.0.0 to 4.4.2
ssh.host_sig.dsa	DSA signature	Byte sequence	4.0.0 to 4.4.2
ssh.host_sig.length	Host signature length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.host_sig.rsa	RSA signature	Byte sequence	4.0.0 to 4.4.2
ssh.host_sig.type	Host signature type	Character string	4.0.0 to 4.4.2
ssh.host_sig.type_length	Host signature type length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.ignore_data	Ignore data	Byte sequence	4.0.0 to 4.4.2
ssh.ignore_data_length	Debug message length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.kex.first_packet_follows	KEX First Packet Follows	Unsigned integer (8 bits)	1.2.0 to 2.2.17
ssh.kex.h_sig	KEX H signature	Byte sequence	2.4.0 to 3.6.24
ssh.kex.h_sig_length	KEX H signature length	Unsigned integer (32 bits)	2.4.0 to 3.6.24
ssh.kex.hassh	hassh	Character string	3.6.0 to 4.4.2
ssh.kex.hassh_algorithms	hasshAlgorithms	Character string	3.6.0 to 4.4.2
ssh.kex.hasshserver	hasshServer	Character string	3.6.0 to 4.4.2
ssh.kex.hasshserver_algorithms	hasshServerAlgorithms	Character string	3.6.0 to 4.4.2
ssh.kex.reserved	Reserved	Byte sequence	1.2.0 to 4.4.2
ssh.kex_algorithms	kex_algorithms string	Character string	1.0.0 to 4.4.2
ssh.kex_algorithms_length	kex_algorithms length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.kexdh.h_sig	KEX DH H signature	Byte sequence	1.2.0 to 2.2.17
ssh.kexdh.h_sig_length	KEX DH H signature length	Unsigned integer (32 bits)	1.2.0 to 2.2.17
ssh.kexdh.host_key	KEX DH host key	Byte sequence	1.2.0 to 2.2.17
ssh.kexdh.host_key_length	KEX DH host key length	Unsigned integer (32 bits)	1.2.0 to 2.0.16
ssh.key_length.error	Invalid key length	Label	4.0.0 to 4.4.2
ssh.lang_tag	Language tag	Character string	4.0.0 to 4.4.2
ssh.lang_tag_length	Language tag length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.languages_client_to_server	languages_client_to_server string	Character string	1.0.0 to 4.4.2
ssh.languages_client_to_server_length	languages_client_to_server length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.languages_server_to_client	languages_server_to_client string	Character string	1.0.0 to 4.4.2
ssh.languages_server_to_client_length	languages_server_to_client length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.mac	MAC	Byte sequence	1.2.0 to 4.4.2
ssh.mac.status	MAC Status	Unsigned integer (8 bits)	4.0.0 to 4.4.2
ssh.mac_algorithms_client_to_server	mac_algorithms_client_to_server string	Character string	1.0.0 to 4.4.2
ssh.mac_algorithms_client_to_server_length	mac_algorithms_client_to_server length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.mac_algorithms_server_to_client	mac_algorithms_server_to_client string	Character string	1.0.0 to 4.4.2
ssh.mac_algorithms_server_to_client_length	mac_algorithms_server_to_client length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.mac_bad.expert	Bad MAC	Label	4.0.0 to 4.4.2
ssh.mac_string	MAC String	Character string	1.0.0 to 1.0.16
ssh.message_code	Message Code	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ssh.mpint_length	Multi Precision Integer Length	Unsigned integer (32 bits)	1.2.0 to 4.4.2
ssh.packet_decode.error	Packet decoded length not equal to packet length	Label	4.0.0 to 4.4.2
ssh.packet_length	Packet Length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.packet_length.error	Overly large number	Label	1.12.0 to 4.4.2
ssh.packet_length_encrypted	Packet Length (encrypted)	Byte sequence	1.12.0 to 4.4.2
ssh.padding_length	Padding Length	Unsigned integer (8 bits)	1.0.0 to 4.4.2
ssh.padding_string	Padding String	Byte sequence	1.0.0 to 4.4.2
ssh.payload	Payload	Byte sequence	1.0.0 to 4.4.2
ssh.ping_data	Data	Byte sequence	4.4.0 to 4.4.2
ssh.ping_data_length	Data length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.pk_blob_length	Public key blob length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.pk_blob_name	Public key blob algorithm name	Character string	4.0.0 to 4.4.2
ssh.pk_blob_name_length	Public key blob algorithm name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.pk_sig_blob_length	Public key signature blob length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.pk_sig_blob_name	Public key signature blob algorithm name	Character string	4.0.0 to 4.4.2
ssh.pk_sig_blob_name_length	Public key signature blob algorithm name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.pong_data	Data	Byte sequence	4.4.0 to 4.4.2
ssh.pong_data_length	Data length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.protocol	Protocol	Character string	1.0.0 to 4.4.2
ssh.reassembled.data	Reassembled PDU data	Byte sequence	4.4.0 to 4.4.2
ssh.reassembled.length	Reassembled PDU length	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.reassembled_in	Reassembled PDU in frame	Frame number	4.4.0 to 4.4.2
ssh.segment	SSH segment	Frame number	4.4.0 to 4.4.2
ssh.segment.count	Segment count	Unsigned integer (32 bits)	4.4.0 to 4.4.2
ssh.segment.data	SSH segment data	Byte sequence	4.4.0 to 4.4.2
ssh.segment.error	Reassembling error	Frame number	4.4.0 to 4.4.2
ssh.segment.multipletails	Multiple tail segments found	Boolean	4.4.0 to 4.4.2
ssh.segment.overlap	Segment overlap	Boolean	4.4.0 to 4.4.2
ssh.segment.overlap.conflict	Conflicting data in segment overlap	Boolean	4.4.0 to 4.4.2
ssh.segment.toolongfragment	Segment too long	Boolean	4.4.0 to 4.4.2
ssh.segments	Reassembled SSH segments	Label	4.4.0 to 4.4.2
ssh.seq_num	Sequence number	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.server_host_key_algorithms	server_host_key_algorithms string	Character string	1.0.0 to 4.4.2
ssh.server_host_key_algorithms_length	server_host_key_algorithms length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
ssh.service_name	Service Name	Character string	4.0.0 to 4.4.2
ssh.service_name_length	Service Name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.sig.ssh-rsa.length	ssh-rsa signature length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.sig.ssh-rsa.s	ssh-rsa signature (s)	Byte sequence	4.0.0 to 4.4.2
ssh.subsystem_name	Subsystem name	Character string	4.0.0 to 4.4.2
ssh.subsystem_name_length	Subsystem name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.userauth.change_password	Change password	Boolean	4.0.0 to 4.4.2
ssh.userauth.have_signature	Have signature	Boolean	4.0.0 to 4.4.2
ssh.userauth.partial_success	Partial success	Boolean	4.0.0 to 4.4.2
ssh.userauth_maximum_packet_size	Maximum packet size	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.userauth_method_name	Method Name	Character string	4.0.0 to 4.4.2
ssh.userauth_method_name_length	Method Name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.userauth_new_password	New password	Character string	4.0.0 to 4.4.2
ssh.userauth_new_password_length	New password length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.userauth_password	Password	Character string	4.0.0 to 4.4.2
ssh.userauth_password_length	Password length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.userauth_pka_name	Public key algorithm name	Character string	4.0.0 to 4.4.2
ssh.userauth_pka_name_length	Public key algorithm name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.userauth_service_name	Service Name	Character string	4.0.0 to 4.4.2
ssh.userauth_service_name_length	Service Name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2
ssh.userauth_user_name	User Name	Character string	4.0.0 to 4.4.2
ssh.userauth_user_name_length	User Name length	Unsigned integer (32 bits)	4.0.0 to 4.4.2