Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

I have one compressed SSH tunnel with one tunnel and multiple connections over it. Data in every connection tunneled is rather homogeneous, but compressing an interleaved stream will obviously make the compression worse. How does SSH compress data with several connections:

  1. On TCP connection level (i.e. one compressed stream, one zlib compression state)?
  2. Or on logical in-tunnel connection level (multiple logical streams over one TCP connection, zlib state for each one)?

Implementation is OpenSSH.

share|improve this question

1 Answer

up vote 4 down vote accepted

Compression is negotiated along with encryption and stream authentication and applies to all data passed over the SSH connection including the protocol commands as well. Compression, when used, is applied followed by stream authentication, and then encryption. The resultant data is what is sent over the Internet. All tunnels/port forwardings/terminal sessions are sent through the same compression stream. The Transport Protocol for SSH is specified in RFC4253.

share|improve this answer
It sounds like if you're sharing your ssh tunnel with somebody, this provides an attack vector for them to derive information about the nature of your traffic by measuring variations in latency and throughput.. – R.. Apr 21 '11 at 5:27
@R.. Someone monitoring the TCP packets with no knowledge of what's going on inside can determine this as well. Since TCP uses Acknowledgements, it's easy for someone to determine the RTT, latency, and Jitter by just watching TCP. Bandwidth is always observable. – penguin359 Apr 21 '11 at 15:49
But someone sharing your tunnel (local interface) might not be able to sniff your external-interface traffic, so this could be leaking additional information they would not otherwise have. – R.. Apr 21 '11 at 16:41
@R.. well, you shouldn't be sharing an SSH Tunnel with an untrusted user anyways. Regardless, compression has nothing to do with detecting latency. Even if compression was independently applied to each tunnel inside an SSH connection, latency would still be the same for the whole connection since TCP enforcing data ordering across the whole TCP connection. Once a packet is sent, northing else can be read by the receiver until that first packet is properly received. If one tunnel using compression sends a large file, it will affect other data going through that SSH connection. – penguin359 Apr 21 '11 at 17:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.