Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was studying the packets exchanged in ssh protocol using wireshark and i noticed that TCP connection is getting established and keys are exchanged, before i accept the server certificate. Isn't it that server has to be authenticated before establishing a connection? The capture shown below is before accepting or rejecting the certificate.

Link to capture image. Sorry, I didn't have privileges to post image here


1. SSH certificate cache was cleared.
2. Certificate was rejected.
share|improve this question
up vote 2 down vote accepted

A TCP connection has to be established before any sort of conversation can take place between hosts, but it is purely for purposes of carrying higher layer traffic and does not do anything more than facilitate that conversation. If the certificate is rejected then the conversation is terminated.

share|improve this answer
Yeah, but why the keys are exchanged?, And the certificate window gave me three options,"yes", "no", "cancel". Selecting "no" would mean rejection, right?, But i was still able to login. The connection was terminated only when i selected "cancel". – Ankit Jun 4 '11 at 22:07
Try running SSH with -v, if you are connecting from a linux host (I'm not sure about Windows versions of ssh) it will show you the authentication process and probably match up well with the packet exchange you have seen in wireshark. – blankabout Jun 4 '11 at 22:33
@Ankit: In PuTTY, the certificate window itself tells you that "Yes" means "Connect and remember key", "No" means "Connect and do not remember key", and "Cancel" means "Cancel the connection". – grawity Jun 4 '11 at 23:02
Thanks, -v showed very useful information, Almost everything in much simpler form than wireshark. And yes, wireshark generated the same output, but in linux it asked me whether or not to continue connection as the server was not trusted. Also, initial exchange is just algorithm negotiation. Random number for session keys are exchanged after accepting the certificate. – Ankit Jun 4 '11 at 23:18
Now i think i understand ssh better, but still need to work on it. Thanks for your help. – Ankit Jun 4 '11 at 23:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.