I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server and see what happens. I ran the following command

sudo tshark -f "tcp port 22"

and then it starts listening on the first available interface. I don't see anything, so I bring up another Terminal screen and ssh to my box. When I connect, an amazingly large amount of packets start being captured, and all the hundreds of thousands of packets look like this:

751253 17.666088 -> TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83725993

Win=1356 Len=0 TSval=739170816 TSecr=8520295
751254  17.666092 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726173 Win=1351 Len=0 TSval=739170816 TSecr=8520295
751255  17.666094 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726209 Win=1350 Len=0 TSval=739170816 TSecr=8520295
751256  17.666096 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726389 Win=1344 Len=0 TSval=739170816 TSecr=8520295
751257  17.666098 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726521 Win=1340 Len=0 TSval=739170816 TSecr=8520295
751258  17.666098 x.x.x.x -> y.y.y.y SSH 198 Encrypted response packet len=132

So my question is, is this expected? Is it normal to have 100,000's of packets be captured by tshark from a single ssh connection in something like 5 seconds?

The rate of the incoming ssh packets seems to grow linearly, so at first it's only capturing maybe 500 packets per second but after 5 seconds or so it's capturing 100,000 packets a second.


You likely created a loop.

packet captured -> output to shell -> packets generated from that output -> back to packet capture

Output to a file quietly (raw) or

tshark -q -f "tcp port 22" -w test.raw

as text by redirecting the output.

tshark -f "tcp port 22" > test.txt
  • Yep that seemed to fix it. @Brian can you explain why packets are generated from the output to stdout? I don't see why packets need to be created to output to the shell. – almel Nov 20 '14 at 22:14
  • 2
    Because your viewing/running the shell over SSH which is a network protocol. – Brian Nov 20 '14 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.