The link talks about TCP over TCP when http is used over SOCKS via SSH.

I am trying to browse from Firefox (on Ubuntu 14.04) after setting up the SOCKS5 proxy option via localhost. I created a SOCKS5 connection using SSH (created using SSH -D) to another host (which then takes the packets and routes them out).

The link says that SSH can be made to work in a none encryption mode, but after applying the small patch suggested there to OpenSSH's cipher.c, I see encrypted packets in wireshark even though it says (encryption:none mac:[email protected] compression:none)

SSH Protocol
    SSH Version 2 (encryption:none mac:[email protected] compression:none)
    Packet Length: 48
    Encrypted Packet: 0932000000076d696e696e65740000000e7373682d636f6e...
    MAC: 1a7bf2cfa15def0f

I would like to verify if this is actually a TCP over TCP connection.

Edit: does it matter that I get prompted for a password when I start the SSH -D (ssh user@host2 -D 8080). Somehow, I am unable to get host2 to not prompt me for a password (even though I added host1's key into host2).

  • If it has different public ip: checkip.amazonaws.com Sep 21, 2016 at 8:38
  • Have you applied the patch to the server too and /etc/ssh/sshd_config? Check the output of the client ssh -vvv -D ...
    – rudimeier
    Sep 21, 2016 at 8:54
  • @Ipor Sircer, not sure if I understand what you meant.
    – nnovoice
    Sep 23, 2016 at 7:58
  • @rudimeier, yes I did. The change to cipher.c is a common to both client and server. I will post the output of ssh -vvv -D. Thank you.
    – nnovoice
    Sep 23, 2016 at 7:59
  • 1
    Note that wireshark writes that the packets are encrypted even if the encryption is "none" (that is, not encrypted) and refuses to dissect those packets. The "encrypted packet" that is in the post indeed looks very much not encrypted. So you probably have no problem with the patch
    – user49822
    Sep 28, 2020 at 14:28

1 Answer 1


I'm not sure what's the problem with that ssh patch. But why are you watching the traffic of the ssh connection? You could sniff the traffic between your web browser and the forwarding socket on lo device instead:

tcpdump -i lo port 10080

Or similar in wireshark.

  • the question I wish to pursue is whether the traffic inside the tunnel is TCP-over-TCP. Will it help to capture the traffic before it gets into the tunnel? But, I did try this: tcpdump -i lo port 8080 -w file.pcap. The capture had nothing related to what I wanted to see. I can share the capture if you would like me to. Thank you.
    – nnovoice
    Sep 23, 2016 at 8:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .