113 reputation
3
bio website cooleyweb.org
location
age
visits member for 2 years, 6 months
seen Feb 2 at 5:44

Mar
19
comment How can I tell if sshd is running with ClientAliveInterval > 0?
I might be wrong, but the TCP-keepalive packets wouldn't have encrypted payloads? The ones I was seeing were, so I assumed it was SSH.
Mar
18
comment How can I tell if sshd is running with ClientAliveInterval > 0?
I feel like just looking for process death could be problematic, as if you won't really be able to tell the difference between sshd just dying (CAI == 0) and a small ClientAliveInterval. However, the tcpdump tip worked pretty well, as of 4.1.1 it didn't seem to decode ssh-keepalive, but the regular pulse of packets every 30 seconds pretty well answered my question.