# SPDX-License-Identifier: AGPL-3.0-only
# Something that is not an SSH client talking to the SSH port:
#   banner exchange: Connection from 203.0.113.9 port 50920: invalid format
#
# The companion line names what was sent ("MGLNDD_<host>_22", "GET /
# HTTP/1.1") but carries no address, so this is the line worth reading.
# Port scanners and internet-wide surveys produce nearly all of it.
parser: ssh-banner-invalid
log: ssh
prefilter: "banner exchange"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: banner exchange: Connection from (?P<ip>[0-9a-fA-F.:]+) port \d+: invalid format$'
time_field: time
time_format: rfc3339
