I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server and see what happens. I ran the following command
sudo tshark -f "tcp port 22"
and then it starts listening on the first available interface. I don't see anything, so I bring up another Terminal screen and ssh to my box. When I connect, an amazingly large amount of packets start being captured, and all the hundreds of thousands of packets look like this:
751253 17.666088 126.96.36.199 -> 188.8.131.52 TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83725993
Win=1356 Len=0 TSval=739170816 TSecr=8520295 751254 17.666092 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726173 Win=1351 Len=0 TSval=739170816 TSecr=8520295 751255 17.666094 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726209 Win=1350 Len=0 TSval=739170816 TSecr=8520295 751256 17.666096 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726389 Win=1344 Len=0 TSval=739170816 TSecr=8520295 751257 17.666098 x.x.x.x -> y.y.y.y TCP 66 53596 > ssh [ACK] Seq=44101 Ack=83726521 Win=1340 Len=0 TSval=739170816 TSecr=8520295 751258 17.666098 x.x.x.x -> y.y.y.y SSH 198 Encrypted response packet len=132
So my question is, is this expected? Is it normal to have 100,000's of packets be captured by tshark from a single ssh connection in something like 5 seconds?
The rate of the incoming ssh packets seems to grow linearly, so at first it's only capturing maybe 500 packets per second but after 5 seconds or so it's capturing 100,000 packets a second.