1

I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server and see what happens. I ran the following command

sudo tshark -f "tcp port 22"

and then it starts listening on the first available interface. I don't see anything, so I bring up another Terminal screen and ssh to my box. When I connect, an amazingly large amount of packets start being captured, and all the hundreds of thousands of packets look like this:

751253 17.666088 134.173.60.192 -> 134.173.63.11 TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83725993

Win=1356 Len=0 TSval=739170816 TSecr=8520295
751254  17.666092 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726173 Win=1351 Len=0 TSval=739170816 TSecr=8520295
751255  17.666094 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726209 Win=1350 Len=0 TSval=739170816 TSecr=8520295
751256  17.666096 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726389 Win=1344 Len=0 TSval=739170816 TSecr=8520295
751257  17.666098 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726521 Win=1340 Len=0 TSval=739170816 TSecr=8520295
751258  17.666098 x.x.x.x -> y.y.y.y SSH 198 Encrypted response packet len=132

So my question is, is this expected? Is it normal to have 100,000's of packets be captured by tshark from a single ssh connection in something like 5 seconds?

The rate of the incoming ssh packets seems to grow linearly, so at first it's only capturing maybe 500 packets per second but after 5 seconds or so it's capturing 100,000 packets a second.

1 Answer 1

3

You likely created a loop.

packet captured -> output to shell -> packets generated from that output -> back to packet capture

Output to a file quietly (raw) or

tshark -q -f "tcp port 22" -w test.raw

as text by redirecting the output.

tshark -f "tcp port 22" > test.txt
2
  • Yep that seemed to fix it. @Brian can you explain why packets are generated from the output to stdout? I don't see why packets need to be created to output to the shell.
    – almel
    Nov 20, 2014 at 22:14
  • 2
    Because your viewing/running the shell over SSH which is a network protocol.
    – Brian
    Nov 20, 2014 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .