Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am comfortable with using the ProxyCommand feature of ssh and can use it to hop through mulitple bastion hosts to reach the final host efficiently. But I just can't seem to understand how it actually works in the backend.

For eg. I have the following config file.

Host final
Port 22
AgentForwarding yes
User guestuser
ProxyCommand "ssh -W %h:%p"

I understand that for connecting to host final, the ProxyCommand will run prior to making the connection to But I still can't seem to understand the order of connections.

And what does the option -W %h:%p do? I understand that it is the netcat feature and is similar to nc %h %p.

So as far as my understanding goes here is the sequence of operations. Kindly let me know if I am wrong. I'm will be using the config file specified above in my example.

  1. The user enters ssh final
  2. An ssh connection to created.
  3. A netcat tunnel is created from to port 22 of The stdin of netcat is connected to the shell obtained in the connection to
  4. So now we have a connection from our system to The first half of this connection is an ssh connection from our system to The second half of this connection is a netcat tunnel from to
  5. Now ssh final command takes the above connection as a proxy and tunnels its data through this existing connection.

Additionally I would also like to know whether this techniques is also known as ssh stacking?

added linebreaks

share|improve this question

3) A netcat tunnel is created from to port 22 of

false, there's no netcat.

1) The user enters ssh final on localhost. This launches the parent ssh process
2) The parent ssh creates a child ssh with I/O redirected to pipes
3) The child ssh creates a connection to
4) The sshd process on creates a tcp connection to
5) An ssh channel is added to existing ssh connection between localhost and
6) Parent ssh writes the handshake data to the pipe, the child ssh reads it from the pipe, sends via the ssh channel to sshd on; sshd reads it and writes it to the socket connected to Similarly, the data is transmitted from to localhost

share|improve this answer
Thanks for your answer. Is this technique also known as ssh stacking or does it have no name? – Naruto Uzumaki Oct 8 '13 at 12:12
Could you please cite a reference? E.g. manual. spec .. – qweruiop Jul 8 '15 at 3:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.