Comment by gitfan86

Yeah, but then you would have ssh traffic without a matching login.

Wonder if any anomaly detection would work on that