HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.
Similar in spirit to what was done for JA3 via https://github.com/salesforce/ja3/pull/45, these changes attempt to bring HASSH to current Zeek standards by de-bro-ing them. I've tested out the changes by installing with Zeek Package Manager on "stock" installs of Zeek v3.0.0 and v3.1.2, as well as manually installing atop our own Zeek fork at https://github.com/brimsec/zeek which was my original intended use case.
Similar in spirit to what was done for JA3 via https://github.com/salesforce/ja3/pull/45, these changes attempt to bring HASSH to current Zeek standards by de-bro-ing them. I've tested out the changes by installing with Zeek Package Manager on "stock" installs of Zeek v3.0.0 and v3.1.2, as well as manually installing atop our own Zeek fork at https://github.com/brimsec/zeek which was my original intended use case.