Skip to main content
protocols.pageprotocols.page
11

SSH_DISCONNECT_BY_APPLICATION

DisconnectRFC 4253 §11.1

SSH_DISCONNECT_BY_APPLICATION (11) is the clean, normal disconnect code sent when an application terminates the SSH session intentionally. This is what appears in server logs for normal session endings: the user logged out, the remote command completed, or the SSH tunnel was closed by the local application.

Code

11

Category

Disconnect

Standard

RFC 4253 §11.1

Description

Code 11 is the standard clean-close disconnect code. When an SSH session ends normally – user types exit, shell process terminates, remote command returns, or the application using SSH channels closes them – the SSH client or server sends SSH_MSG_DISCONNECT with reason code 11.

This is the SSH equivalent of a clean TCP FIN. Server logs showing disconnect code 11 indicate normal operation. A high rate of code 11 disconnects in quick succession might indicate connection pooling behavior, automation running short-lived commands, or port scanners that open and immediately close SSH connections.

Code 11 is the most common disconnect code in any SSH server log. It is not an error condition.

Common Causes

  • –User typed exit or logout in an interactive SSH session
  • –Remote shell process terminated normally
  • –SSH tunnel closed by the local application
  • –Remote command execution completed and process exited
  • –SSH client application shut down cleanly
RFC 4253 – SSH specification →