On Mon, Jun 23, 2014 at 10:16:21PM +0200, Manuel Bouyer wrote: > > So it could actually have closed the connection after that. > Did your tcpdump sequences also capture ICMP traffics ? > Did an ICMP network unreacheable packet show up ?
I just created a new capture, this time with icmp: tcpdump -nvvv icmp or \( tcp port ssh and not tcp src port 60227 and not tcp dst port 60227 and not tcp src port 60178 and not tcp dst port 60178 \) 60227 and 60178 were used by two interactive sessions. Unfortunately, there is no ICMP in the capture except the first two packets which were sent by me in order to test the filter expression: http://smokva.net/pcap/crane-with-icmp.txt