My network has IPv6, and I usually use IPv6 addresses to connect to
them. It is globally reachable addresses.
When I connect to ssh server and keep the shell running (without
activity, no tmux with "moving" status bar due to date or loadavg),
after some time (10min seems enough) if I start typing in the terminal,
the first char is sent to server, and the connection reset. the client
doesn't see the echo of the char (I know server has the char because on
simple tmux session, when reattach, the char is present).
This time, I managed to have a tcpdump trace on the client, and on the
server for the problem. After comparing packet per packet the output,
the two hosts saw the same things.
Here the tcpdump output (-vvv). I used sed to rename IPv6 addresses to
names (for better lisibility).
bert is the SSH server : 2001:41d0:fe39:c05c:afcb:ae83:596f:47e5 (stable soii address)
clyde is the SSH client : 2001:41d0:fe39:c05c:f5eb:676d:ef8f:61f (current active outgoing autoconfprivacy address)
On Wed, Aug 14, 2019 at 12:33:04PM +0200, Sebastien Marie wrote:
> 10:52:43.021623 clyde.39234 > bert.22: P 1:37(36) ack 120 win 256 <nop,nop,timestamp 144013579 2288520555> [class 0x48] [flowlabel 0x46f7a] (len 68, hlim 64)
> 10:52:43.022002 bert.22 > clyde.39234: P 120:164(44) ack 37 win 267 <nop,nop,timestamp 2288522085 144013579> [class 0x48] [flowlabel 0x6d55f] (len 76, hlim 64)
> 10:52:43.022081 clyde.39234 > bert.22: R [tcp sum ok] 652718888:652718888(0) win 0 (len 20, hlim 64)
So you see TCP resets that make no sense after some time of inactivity.
In my experience this is a bridge(4) somewhere in the network running
pf(4) with a default "block return" rule. The entries in the bridge
MAC table timeout, the bridge sends a broadcast to all ports, this
packet hits pf on an interface, where it is not expected. Then pf
generates a TCP reset packet.
Run tcpdump -e and check whether the MAC address of the reset matches
clyde or bert. If not, you have the bad machine.
On Wed, 14 Aug 2019 at 04:02, Sebastien Marie <[hidden email]> wrote:
> When I connect to ssh server and keep the shell running (without
> activity, no tmux with "moving" status bar due to date or loadavg),
> after some time (10min seems enough) if I start typing in the terminal,
> the first char is sent to server, and the connection reset. the client
> doesn't see the echo of the char (I know server has the char because on
> simple tmux session, when reattach, the char is present).
FWIW if this is caused by some kind inactivity timeout you can
mitigate it by enabling ServerAliveInterval in the ssh client or the
equivalent ClientAliveInterval in the sshdconfiguration.
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860 37F4 9357 ECEF 11EA A6FA (new)
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.