Signature for non-protocol traffic on standard port

[tami.martin]

I've found signature to detect SSH traffic on a non-standard port (not port 22), but is there a signature that detects non-ssh traffic on port 22? Alternatively, is there any suggestions on how to create a custom signature to do this? We are also looking for non-ftp on port 21 or 20

[mhellman]

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&topicID=.ee6e1fc&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cbedd97/3#selected_message

sorry, that link explains how to detect SSH tunneling over HTTP ports, which isn't what you asked for. I'll have to think about it.