# long SSH connection in conn.log

**URL:** <https://community.zeek.org/t/long-ssh-connection-in-conn-log/3807>\
**Category:** Zeek\
**Created:** [September 3, 2015, 10:08pm UTC](https://community.zeek.org/t/long-ssh-connection-in-conn-log/3807 "2015-09-03T22:08:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sven\_Dreyer](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@Sven\_Dreyer](https://community.zeek.org/u/Sven_Dreyer)\
**Post date:** [September 3, 2015, 10:08pm UTC](https://community.zeek.org/t/long-ssh-connection-in-conn-log/3807/1 "2015-09-03T22:08:56Z")

</div>

Dear list,

I started an SSH connection in my LAN on 3:32pm which lasted until 07:04pm - so we're talking about an SSH session lasting 3 1/2 hours.

In my conn.log files, I find this single SSH connection as 5 connections:

1) conn\_state S1, service ssh  
2-4) conn\_state OTH, service -  
5) conn\_state SF, service -

Bro was started before the SSH connection was initiated, so I'd expect a single conn.log entry to be written when I disconnect. Or did I get something wrong here?

Thanks!  
Sven

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [September 15, 2015, 4:18pm UTC](https://community.zeek.org/t/long-ssh-connection-in-conn-log/3807/2 "2015-09-15T16:18:54Z")

</div>

Hello Sven,

you are probably running into internal Bro timeouts here. Generally, since  
Bro can only use limited amounts of RAM, Bro automatically times out  
connections after it does not see any activity (exchanged packets) for a  
specified period of time. For TCP, this is generally 5 minutes, defined in  
tcp\_inactivity\_timeout.

Since interactive protocols tend to have longer periods of time where we  
might not see any exchanged connections, Bro has special settings for them  
- in base/protocols/conn/inactivity.bro the timeout for identified SSH  
sessions is set to 1 hour. However, if your session does not exchange any  
packets for more than one hour, Bro will assume that it has been closed  
and just not seen the packets closing the connection. Everything following  
will be regarded as a new connection - and in your case fall under the  
default 5 minute timeout since it cannot reliably be identified as SSH.

This is a generic problem - you have to just assume that connections are  
terminated after you did not see any exchanged data for a specified period  
of time. In case the current Bro settings do not work for you, you can  
redef them.

I hope that helps,  
Johanna

---

<div class="post-metadata">

**Author:** ![Sven\_Dreyer](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@Sven\_Dreyer](https://community.zeek.org/u/Sven_Dreyer)\
**Post date:** [September 22, 2015, 12:08pm UTC](https://community.zeek.org/t/long-ssh-connection-in-conn-log/3807/3 "2015-09-22T12:08:53Z")

</div>

Hi Johanna,

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/long-ssh-connection-in-conn-log/3807/4 "2022-05-06T15:43:02Z")

</div>

Closed on May 6, 2022, 3:43pm UTC