RFC 4253 says of SSH:

6.1. Maximum Packet Length

All implementations MUST be able to process packets with an uncompressed payload length of 32768 bytes or less and a total packet size of 35000 bytes or less (including 'packet_length', 'padding_length', 'payload', 'random padding', and 'mac'). The maximum of 35000 bytes is an arbitrarily chosen value that is larger than the uncompressed length noted above. Implementations SHOULD support longer packets, where they might be needed. For example, if an implementation wants to send a very large number of certificates, the larger packets MAY be sent if the identification string indicates that the other party is able to process them. However, implementations SHOULD check that the packet length is reasonable in order for the implementation to avoid denial of service and/or buffer overflow attacks.

It does not say what the maximum packet length should be but it does advise that the length should be 'reasonable'.

Cisco implementations have a 35000 bytes maximum packet length; anything larger is dropped.

I tried googling for a similar setting in OpenSSH but came out empty.

Does OpenSSH have such a limit?

  • 1
    This really isn't a security question but a design question for the OpenSSH package. – schroeder Jul 8 '16 at 11:46

If you read the code: https://github.com/openssh/openssh-portable/blob/18813a32b6fd964037e0f5e1893cb4468ac6a758/packet.c

You will see this line: state->max_packet_size = 32768;

Always check out the code. All I did was run a search on the Github repo for "max packet" and this was the top result.

| improve this answer | |
  • The openssh maximum packet length is 256KB. See line 96 of the linked file you included in your answer (and line 1568). – logicalscope Feb 3 '17 at 20:15
  • @logicalscope yep saw that, but that's not the question. The question is if there was a 32768 restriction. There is, in one part. I was hoping that the 'search for max packet' would also hopefully answer the question that was not specifically asked. – schroeder Feb 3 '17 at 21:55
  • I have tested this many times using tools. OpenSSH has a maximum packet size of 256KB. Other implementations have different max sizes (but 256KB is common). With OpenSSH, anything larger will cause the recipient to terminate. This can be confirmed by modifying the ssh code to force feed a 256KB + epsilon bytes packet after the initial hanshake (because some aspects of the initial handshake uses fixed-size buffers). – logicalscope Feb 4 '17 at 2:52
  • @logicalscope I'm not debating that, I believe you, but you are addressing something different from what I am. – schroeder Feb 4 '17 at 7:41
  • with all due respect, if you are addressing a concern then it is not the original poster's question. The poster was asking for an analogue to Cisco's max packet limit for OpenSSH. – logicalscope Feb 4 '17 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.