5

I'm actually having a bit of an odd problem. I'm running Ubuntu Server 12.04, with a minimal set of packages: The base system, sshd, and an IRC server. I must allow someone else to configure the server to connect to their IRC network. However, they seem to be dropping after two lines of ls or cat.

Odder, this only happens on this server, and I haven't been able to reproduce it at all using PuTTY or an ssh client. Where should I look to diagnose this? auth.log shows a normal connection and authentication and does not give any details about the drop. fail2ban has no violations with the originating IP address.

This is a virtual machine with a forwarded port(it is bridge mode and has normal network connectivity). I can connect locally, across the LAN, and from a remote location with PuTTY without any problems. The other person can connect using ssh on Linux but encounters the connection dropping.

Logs from client.

Server-side logs show nothing out of the ordinary.

12
  • Try connecting with the -vvv option ssh -vvv user@server
    – Panther
    Jun 7, 2013 at 20:48
  • @bodhi.zazen and other commenters: I'm working with someone else that's having this issue so I'll respond as soon as I know.
    – nanofarad
    Jun 7, 2013 at 20:49
  • 1
    Is "someone else" connecting from the Internet? Are YOU connecting from the Internet or from LAN? Can you describe or even draw a diagram of your network? Is this server a virtual machine? Jun 7, 2013 at 22:26
  • 4
    Weird! I'd start ruling out pieces with things like ssh -F /dev/null user@host to rule out the client's /etc/ssh/ssh_config and .ssh/config... and also ssh -t user@host bash --noprofile --norc to rule out something happening in /etc/profile,~/.bash_profile,~/.bashrc, etc. If the latter works, I'd run "bash" within the profile-less bash to get a normal bash and see if that exits unexpectedly.
    – Steven K
    Jun 18, 2013 at 19:19
  • 1
    Steven's suggestions are solid if it's coming from something in the user's environment on the server. To test whether the problem is client-side, see if you can intercept the "exit" command string by bypassing bash completely: ssh -t [email protected] cat
    – Paul
    Jun 19, 2013 at 23:38

4 Answers 4

1

Before you start, make sure that the system time at both ends are synchronized. This helps with the comparison later.

Run tcpdump at both ends, filtered for TCP port 22. You mention that the client is using PuTTY so I assume Windows. You can get wireshark for Windows and it has a capture capability that you can use in place of tcpdump.

Using tcpdump, you would do this with something like: tcpdump -w/tmp/ssh.pcap -s0 -ieth0 port 22. With wireshark on Windows, you can set up a capture filtered for port 22 using the GUI, and then save the capture to disk.

Now open up both captures with wireshark. Find the point of disconnection. You should be able to see which end initiated the connection shutdown (where does a FIN or RST connection arrive from first?)

You can also check to see if a third party host (eg. a router, or an ISP) is interfering with the connection. You'll identify this if you spot a packet arriving that was never sent from the other side, for example. If this is happening, it is likely to be an RST packet.

0

I've experienced weird ssh timeouts and I resolved it using the following:

sudo sysctl -w net.ipv4.tcp_keepalive_time=50 \
 net.ipv4.tcp_keepalive_intvl=10 \
 net.ipv4.tcp_keepalive_probes=5 

Not sure if this will help, but maybe it is worth giving it a try.

2
  • 2
    On the server? Or the client?
    – nanofarad
    Jun 17, 2013 at 19:41
  • @ObsessiveSSOℲ on the client.
    – guntbert
    Jun 20, 2013 at 16:17
0

Hard to tell without a better description of the problem (what does "dropping" mean? TCP teardown? TCP RST? Stalled connection?), but one possible interpretation of your description is that there could be a problem with path MTU discovery...

SSH Frequently Asked Questions : My SSH session hangs part way through logging on, when I generate a lot of output from my shell...

PMTU (Path MTU) Discovery

3
  • If you look at the logs I've linked, you can see that the "dropping" happens in software where the client reports a normal soft disconnection. This has nothing to do with a hard socket failure as far as I can tell.
    – nanofarad
    Jun 18, 2013 at 2:00
  • ... but, those logs include the client issuing the "exit" command, at which point the correct behavior is for the connection to drop...?
    – Steven K
    Jun 18, 2013 at 4:51
  • Exactly. The exit command is never issued by either endpoint's user or the server's configuration, so I'm trying to diagnose why the client is doing this.
    – nanofarad
    Jun 18, 2013 at 12:13
0

I had this exact problem connecting to an old 12.04 server from a LTS14.04 (previously upgraded from 12.04)

I found that the problem is MTU related as after running

sudo ip li set mtu 1480 dev eth0

The problem goes away..... and returns when you set it back to 1500

(assumes you are on a wired eth0 connection)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .