On this page
OSSEC / HIDS Rule 5701
- Rule family: OSSEC / HIDS
- Rule ID: 5701
- Definition status: Present in current source
- Alert message / subject: Possible attack on the ssh server (or version gathering).
- Rule level: 8
- Definition checked: 2026-10-21
Interpretation and response
This event is recorded as “Possible attack on the ssh server (or version gathering).” Review the originating log and the affected host or service to determine whether the activity was expected.
An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.
Documentation
The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.
Description
This rule is triggered when a connection is made to the SSH service that does not actually try to create an SSH connection. This does not occur with actual SSH client connections. This occurs when a connection does not negotiate with the SSH daemon as an SSH aware client. For example, telneting to the SSH port will generate this alert.
This method is used by attackers to determine if SSH is running on the system, and what version of SSH the system is using.
Log example
Illustrative event summary (not a captured log): OSSEC/HIDS 5701 — Possible attack on the ssh server (or version gathering)..
Troubleshooting
False Positives
Some simple or old monitoring packages may use this method to see if the SSH service is up, which can generate a false positive.
Tuning Guidance
We do not recommend you disable this rule. Instead if your monitoring system is generating this alert, we recommend you whitelist the IP or change to a monitoring solution that actually establishes an SSH aware connection to the SSH service.
If you do not wish to shun on this rule, just change the Rules configuration for Active Response to “no”. We do not recommend you disable active response on this rule, as this method is widely used to probe ssh servers.
Additional Information
Similar Rules
Source and revision
Migrated from HIDS_5701, wiki page 482, revision 4031 (20131005). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.
For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .