Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm actually having a bit of an odd problem. I'm running Ubuntu Server 12.04, with a minimal set of packages: The base system, sshd, and an IRC server. I must allow someone else to configure the server to connect to their IRC network. However, they seem to be dropping after two lines of ls or cat.

Odder, this only happens on this server, and I haven't been able to reproduce it at all using PuTTY or an ssh client. Where should I look to diagnose this? auth.log shows a normal connection and authentication and does not give any details about the drop. fail2ban has no violations with the originating IP address.

This is a virtual machine with a forwarded port(it is bridge mode and has normal network connectivity). I can connect locally, across the LAN, and from a remote location with PuTTY without any problems. The other person can connect using ssh on Linux but encounters the connection dropping.

Logs from client.

Server-side logs show nothing out of the ordinary.

share|improve this question
    
Try connecting with the -vvv option ssh -vvv user@server –  bodhi.zazen Jun 7 '13 at 20:48
    
@bodhi.zazen and other commenters: I'm working with someone else that's having this issue so I'll respond as soon as I know. –  hexafraction Jun 7 '13 at 20:49
1  
Is "someone else" connecting from the Internet? Are YOU connecting from the Internet or from LAN? Can you describe or even draw a diagram of your network? Is this server a virtual machine? –  Eric Carvalho Jun 7 '13 at 22:26
4  
Weird! I'd start ruling out pieces with things like ssh -F /dev/null user@host to rule out the client's /etc/ssh/ssh_config and .ssh/config... and also ssh -t user@host bash --noprofile --norc to rule out something happening in /etc/profile,~/.bash_profile,~/.bashrc, etc. If the latter works, I'd run "bash" within the profile-less bash to get a normal bash and see if that exits unexpectedly. –  Steven Kath Jun 18 '13 at 19:19
1  
Steven's suggestions are solid if it's coming from something in the user's environment on the server. To test whether the problem is client-side, see if you can intercept the "exit" command string by bypassing bash completely: ssh -t [email protected] cat –  Paul Jun 19 '13 at 23:38

4 Answers 4

Before you start, make sure that the system time at both ends are synchronized. This helps with the comparison later.

Run tcpdump at both ends, filtered for TCP port 22. You mention that the client is using PuTTY so I assume Windows. You can get wireshark for Windows and it has a capture capability that you can use in place of tcpdump.

Using tcpdump, you would do this with something like: tcpdump -w/tmp/ssh.pcap -s0 -ieth0 port 22. With wireshark on Windows, you can set up a capture filtered for port 22 using the GUI, and then save the capture to disk.

Now open up both captures with wireshark. Find the point of disconnection. You should be able to see which end initiated the connection shutdown (where does a FIN or RST connection arrive from first?)

You can also check to see if a third party host (eg. a router, or an ISP) is interfering with the connection. You'll identify this if you spot a packet arriving that was never sent from the other side, for example. If this is happening, it is likely to be an RST packet.

share|improve this answer

I've experienced weird ssh timeouts and I resolved it using the following:

sudo sysctl -w net.ipv4.tcp_keepalive_time=50 \
 net.ipv4.tcp_keepalive_intvl=10 \
 net.ipv4.tcp_keepalive_probes=5 

Not sure if this will help, but maybe it is worth giving it a try.

share|improve this answer
2  
On the server? Or the client? –  hexafraction Jun 17 '13 at 19:41
    
@ObsessiveSSOℲ on the client. –  guntbert Jun 20 '13 at 16:17

Hard to tell without a better description of the problem (what does "dropping" mean? TCP teardown? TCP RST? Stalled connection?), but one possible interpretation of your description is that there could be a problem with path MTU discovery...

SSH Frequently Asked Questions : My SSH session hangs part way through logging on, when I generate a lot of output from my shell...

PMTU (Path MTU) Discovery

share|improve this answer
    
If you look at the logs I've linked, you can see that the "dropping" happens in software where the client reports a normal soft disconnection. This has nothing to do with a hard socket failure as far as I can tell. –  hexafraction Jun 18 '13 at 2:00
    
... but, those logs include the client issuing the "exit" command, at which point the correct behavior is for the connection to drop...? –  Steven Kath Jun 18 '13 at 4:51
    
Exactly. The exit command is never issued by either endpoint's user or the server's configuration, so I'm trying to diagnose why the client is doing this. –  hexafraction Jun 18 '13 at 12:13

I had this exact problem connecting to an old 12.04 server from a LTS14.04 (previously upgraded from 12.04)

I found that the problem is MTU related as after running

sudo ip li set mtu 1480 dev eth0

The problem goes away..... and returns when you set it back to 1500

(assumes you are on a wired eth0 connection)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.