SSHOW - Implementation libnids provides TCP session tracking and per-connection stateful callbacks SSH-1 application layer packet reassembly Client-to-server and server-to-client callbacks accumulate session history Debugging mode prints summary info per reassembled SSH packet