📦
ネットワークの観察 - 第1回 SSHを解析する
はじめに
SSHの接続はどのようになっているのでしょうか？今回はwiresharkを使用して確認してみます。
また、今回だけでなく次回以降も様々なネットワークの事象について観察していきたいと思います。
マシンスペック
MacBook Air M2 arm64
Docker上で実施
準備
wiresharkのインストール
brew install --cask wireshark
Dockerfile
FROM ubuntu:24.04
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y \
openssh-server openssh-client \
strace tcpdump vim less procps iproute2 \
&& mkdir -p /var/run/sshd \
&& useradd -m test && echo 'test:test' | chpasswd \
&& ssh-keygen -A \
&& echo 'PermitRootLogin no' >> /etc/ssh/sshd_config \
&& echo 'PasswordAuthentication yes' >> /etc/ssh/sshd_config
WORKDIR /work
CMD ["bash"]
docker‑compose.yml
version: "3.9"
services:
ssh-server:
build: .
container_name: ssh-server
hostname: ssh-server
ports:
- "2222:22"
command: >
bash -c "
strace -ff -o /work/sshd_trace
/usr/sbin/sshd -D -e
"
networks: [sshnet]
ssh-client:
build: .
container_name: ssh-client
hostname: ssh-client
command: tail -f /dev/null # 手動実行用
networks: [sshnet]
packet-capture:
build: .
container_name: packet-capture
cap_add: [NET_ADMIN]
command: tail -f /dev/null
volumes:
- ./pcap:/pcap
networks: [sshnet]
networks:
sshnet:
driver: bridge
実験
パケットキャプチャ開始
docker exec -d ssh-server \
tcpdump -i any -w /work/ssh_server.pcap port 22
クライアント側strace＋SSH実行
docker exec -it ssh-client bash
# ↓コンテナ内
strace -ff -o /work/ssh_trace ssh test@ssh-server
# パスワード: test
キャプチャの停止
docker exec ssh-server pkill tcpdump
データのコピー
docker cp ssh-server:/work/ssh_server.pcap ./pcap/
open pcap/ssh_server.pcap # Wireshark で開く
結果
1 0.000000 xx.xx.xx.2 xx.xx.xx.3 TCP 80 34736 → 22 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=3708330286 TSecr=0 WS=128
2 0.000045 xx.xx.xx.3 xx.xx.xx.2 TCP 80 22 → 34736 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=1279570470 TSecr=3708330286 WS=128
3 0.000089 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=3708330286 TSecr=1279570470
4 0.000364 xx.xx.xx.2 xx.xx.xx.3 SSHv2 115 Client: Protocol (SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.13)
5 0.000374 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [ACK] Seq=1 Ack=44 Win=65152 Len=0 TSval=1279570470 TSecr=3708330286
6 0.011727 xx.xx.xx.3 xx.xx.xx.2 SSHv2 115 Server: Protocol (SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.13)
7 0.011806 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=44 Ack=44 Win=64256 Len=0 TSval=3708330298 TSecr=1279570481
8 0.012321 xx.xx.xx.2 xx.xx.xx.3 SSHv2 1608 Client: Key Exchange Init
9 0.012331 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [ACK] Seq=44 Ack=1580 Win=67200 Len=0 TSval=1279570482 TSecr=3708330298
10 0.013180 xx.xx.xx.3 xx.xx.xx.2 SSHv2 1192 Server: Key Exchange Init
11 0.045769 xx.xx.xx.2 xx.xx.xx.3 SSHv2 1280 Client: Diffie-Hellman Key Exchange Init
12 0.056453 xx.xx.xx.3 xx.xx.xx.2 SSHv2 1604 Server: Diffie-Hellman Key Exchange Reply, New Keys, Encrypted packet (len=284)
13 0.056466 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=2788 Ack=2696 Win=70144 Len=0 TSval=3708330342 TSecr=1279570526
14 0.076108 xx.xx.xx.2 xx.xx.xx.3 SSHv2 156 Client: New Keys, Encrypted packet (len=68)
15 0.121801 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [ACK] Seq=2696 Ack=2872 Win=70144 Len=0 TSval=1279570592 TSecr=3708330362
16 0.121830 xx.xx.xx.2 xx.xx.xx.3 SSHv2 116 Client: Encrypted packet (len=44)
17 0.121833 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [ACK] Seq=2696 Ack=2916 Win=70144 Len=0 TSval=1279570592 TSecr=3708330408
18 0.121854 xx.xx.xx.3 xx.xx.xx.2 SSHv2 116 Server: Encrypted packet (len=44)
19 0.121889 xx.xx.xx.2 xx.xx.xx.3 SSHv2 132 Client: Encrypted packet (len=60)
20 0.122477 xx.xx.xx.3 xx.xx.xx.2 SSHv2 336 Server: Encrypted packet (len=264)
21 0.167827 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=2976 Ack=3004 Win=72960 Len=0 TSval=3708330454 TSecr=1279570592
22 2.199489 xx.xx.xx.2 xx.xx.xx.3 SSHv2 156 Client: Encrypted packet (len=84)
23 2.239764 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [ACK] Seq=3004 Ack=3060 Win=70144 Len=0 TSval=1279572710 TSecr=3708332485
24 2.269558 xx.xx.xx.3 xx.xx.xx.2 SSHv2 100 Server: Encrypted packet (len=28)
25 2.269580 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=3060 Ack=3032 Win=72960 Len=0 TSval=3708332555 TSecr=1279572739
26 2.269735 xx.xx.xx.2 xx.xx.xx.3 SSHv2 184 Client: Encrypted packet (len=112)
27 2.269739 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [ACK] Seq=3032 Ack=3172 Win=70144 Len=0 TSval=1279572739 TSecr=3708332555
28 2.276300 xx.xx.xx.3 xx.xx.xx.2 SSHv2 700 Server: Encrypted packet (len=628)
29 2.318332 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=3172 Ack=3660 Win=75904 Len=0 TSval=3708332604 TSecr=1279572746
30 2.318336 xx.xx.xx.3 xx.xx.xx.2 SSHv2 116 Server: Encrypted packet (len=44)
31 2.318353 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=3172 Ack=3704 Win=75904 Len=0 TSval=3708332604 TSecr=1279572788
32 2.318436 xx.xx.xx.2 xx.xx.xx.3 SSHv2 448 Client: Encrypted packet (len=376)
33 2.319165 xx.xx.xx.3 xx.xx.xx.2 SSHv2 180 Server: Encrypted packet (len=108)
34 2.319340 xx.xx.xx.3 xx.xx.xx.2 SSHv2 572 Server: Encrypted packet (len=500)
35 2.319389 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=3548 Ack=4312 Win=78848 Len=0 TSval=3708332605 TSecr=1279572789
36 2.321605 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
37 2.361804 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=3548 Ack=4348 Win=78848 Len=0 TSval=3708332648 TSecr=1279572791
38 2.898938 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
39 2.899316 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
40 2.899385 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=3584 Ack=4384 Win=78848 Len=0 TSval=3708333185 TSecr=1279573369
41 2.923810 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
42 2.923991 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
43 2.943026 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
44 2.943186 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
45 2.966318 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
46 2.966500 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
47 2.989367 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
48 2.989508 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
49 3.010811 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
50 3.010931 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
51 3.034556 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
52 3.034679 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
53 3.058339 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
54 3.058451 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
55 3.078958 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
56 3.079060 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
57 3.098987 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
58 3.099120 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
59 3.117988 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
60 3.118226 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
61 3.141282 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
62 3.141354 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
63 3.163306 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
64 3.163416 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
65 3.186674 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
66 3.186861 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
67 3.208130 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
68 3.208243 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
69 3.231456 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
70 3.231573 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
71 3.253097 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
72 3.253207 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
73 3.276502 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
74 3.276614 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
75 3.300612 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
76 3.300723 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
77 3.323991 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
78 3.324099 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
79 3.346534 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
80 3.346645 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
81 3.369405 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
82 3.369509 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
83 3.392325 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
84 3.392421 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
85 3.414275 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
86 3.414430 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
87 3.437413 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
88 3.437522 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
89 3.460349 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
90 3.460467 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
91 3.484668 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
92 3.484812 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
93 3.508585 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
94 3.508692 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
95 3.529864 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
96 3.529973 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
97 3.553575 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
98 3.553687 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
99 3.575152 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
100 3.575257 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
101 3.597361 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
102 3.597465 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
103 3.621663 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
104 3.621820 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
105 3.644652 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
106 3.644793 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
107 3.668306 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
108 3.668417 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
109 3.692675 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
110 3.692823 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
111 3.717821 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
112 3.717926 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
113 3.739390 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
114 3.739699 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
115 3.763519 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
116 3.763632 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
117 3.786902 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
118 3.787190 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
119 3.806893 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
120 3.807030 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
121 3.828733 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
122 3.828841 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
123 3.849999 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
124 3.850140 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
125 3.874477 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
126 3.874601 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
127 3.897484 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
128 3.897622 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
129 3.919926 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
130 3.920072 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
131 3.944860 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
132 3.944989 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
133 3.970867 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
134 3.970975 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
135 3.993901 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
136 3.994008 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
137 4.017511 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
138 4.017614 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
139 4.038049 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
140 4.038189 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
141 4.060654 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
142 4.060831 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
143 4.085718 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
144 4.086035 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
145 4.110722 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
146 4.110842 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
147 4.134695 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
148 4.134850 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
149 4.158663 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
150 4.158868 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
151 4.178894 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
152 4.179045 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
153 4.201117 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
154 4.201271 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
155 4.221103 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
156 4.221427 xx.xx.xx.3 xx.xx.xx.2 SSHv2 108 Server: Encrypted packet (len=36)
157 4.221929 xx.xx.xx.3 xx.xx.xx.2 SSHv2 248 Server: Encrypted packet (len=176)
158 4.222103 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=5672 Ack=6648 Win=81664 Len=0 TSval=3708334508 TSecr=1279574691
159 4.222229 xx.xx.xx.2 xx.xx.xx.3 SSHv2 108 Client: Encrypted packet (len=36)
160 4.222257 xx.xx.xx.2 xx.xx.xx.3 SSHv2 132 Client: Encrypted packet (len=60)
161 4.222296 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [FIN, ACK] Seq=5768 Ack=6648 Win=81664 Len=0 TSval=3708334508 TSecr=1279574691
162 4.222499 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [ACK] Seq=6648 Ack=5769 Win=72960 Len=0 TSval=1279574692 TSecr=3708334508
163 4.225022 xx.xx.xx.3 xx.xx.xx.2 TCP 72 22 → 34736 [FIN, ACK] Seq=6648 Ack=5769 Win=72960 Len=0 TSval=1279574695 TSecr=3708334508
164 4.225071 xx.xx.xx.2 xx.xx.xx.3 TCP 72 34736 → 22 [ACK] Seq=5769 Ack=6649 Win=81664 Len=0 TSval=3708334511 TSecr=1279574695
まとめ
| # | 時刻 (相対) | 主要イベント | 説明 |
|---|---|---|---|
| 1‑3 | 0.0000s | TCP 3‑way handshake |
SYN→SYN/ACK→ACK で xx.xx.xx.2 (client) ⇄ xx.xx.xx.3 (server) のコネクション確立。 |
| 4&6 | 0.0003s 0.0117s | プロトコル・バージョン交換 |
SSH‑2.0‑OpenSSH_9.6p1 … が平文で往復。以降 SSH2。 |
| 8&10 | 0.012s | Key Exchange Init (KEXINIT) | アルゴリズム候補・圧縮方式などを双方送信。 |
| 11‑14 | 0.045‑0.076s | Diffie‑Hellman鍵交換+New Keys | 秘密共有を生成し、暗号化モードへ切替。直後のパケットから payload が暗号化 され長さだけ見える。 |
| 16‑20 | 0.12 s 前後 | ユーザ認証フェーズ | クライアント → サーバ：USERAUTH_REQUEST (ここでは password)。サーバ → クライアント： USERAUTH_SUCCESS。両パケットとも暗号化済みで長さのみ確認可。 |
| 22‑34 | 2.19‑2.32s | チャネル確立 & シェル起動 |
CHANNEL_OPEN, CHANNEL_REQUEST, CHANNEL_SUCCESS など。暗号化パケットが増えているのが見て取れる。 |
| 38‑149 | 2.89‑4.16s | インタラクティブなシェル I/O | 36byte 前後の暗号化パケットが高頻度で往復。これは端末エコー（プロンプト表示・キー入力）の典型的サイズ。 |
| 157‑164 | 4.22s | セッション終了 | クライアント→サーバ FIN, サーバ→クライアント FIN/ACK。TCP が正常にクローズ。 |
最後に
今回はsshの接続を深掘りしてみました、皆様の学習のお役に立てると幸いです。
Discussion
データの暗号化が始まった後の部分が憶測になってしまっているのが残念に思います。
キャプチャーデータだけから判断するにしても、時刻やパケット数に注目すればもっとよかったのではないかと思います。
例えば、16～20をユーザー認証フェーズとしていますが、鍵交換が終了して暗号化が開始されてから0.05秒しか経っていません。この僅かな時間の間にパスワードのプロンプトを確認してパスワードを入力したと考えるのは無理がないでしょうか?
また、この後の22のパケットが送られるまで2秒程度の間があります。パスワードの入力はこの間に行われたと考える方が自然ではないでしょうか。
他には38～149をキー入力とそのエコーバックとしていますが、パケット数が100以上、送信だけに限っても50以上あります。そして送信間隔もほぼ20ミリ秒程度と均一になっています。50キー以上を均一な間隔で入力したのでしょうか? 実際にはもっと少なくはありませんか?
この部分に関しては日本語での情報も少ないので答えを書きますが、Keystroke Timing Obfuscationという機能が動いています。
他の方法も併用するならば、
sshコマンドに-vvvオプションをつけてどのようなパケットを送受信したかをしらべ、それとキャプチャーデータを見比べてみるのもいいでしょう。16～20で実際には何を行っていたかも見えてくるかもしれません。