This question already has an answer here:

When I type "tcpdump" on any VPS server I own I get many requests apparently from my own machine to the SSH port. Is this normal?

marked as duplicate by Community Nov 14 '18 at 19:43

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from webmasters.stackexchange.com Nov 14 '18 at 15:16

This question came from our site for pro webmasters.


Tcpdump will output to the terminal. Terminal is created by ssh and anything on it is transferred over ssh between your vps and your client machine. This is basically what you see in tcpdump.

So yes, this is normal.


Without seeing the actual tcpdump commandline and filter options:

You're probably accessing your VPS over SSH to run tcpdump...

Each bit of output from the tcpdump command itself will need to be transmitted over SSH to your screen and gets registered by tcpdump (again generating more SSH traffic)

So that is completely expected.

Not the answer you're looking for? Browse other questions tagged or ask your own question.