Comment by api

They might mean SSH TCP traffic logs, maybe?

Also SSH isn't a perfectly opaque protocol. There's stuff you can use to fingerprint e.g. client/server versions and often narrow it to architecture, OS, even OS version. That helps.