SSH_DISCONNECT_MAC_ERROR
SSH_DISCONNECT_MAC_ERROR (5) is sent when an SSH packet's Message Authentication Code (MAC) does not verify. The packet was received but its integrity check failed, indicating the packet was corrupted in transit or actively tampered with. The connection must be terminated immediately.
Code
5
Category
Disconnect
Standard
RFC 4253 §11.1
Description
SSH uses per-packet MAC codes to ensure integrity of every SSH message after key exchange. The MAC is computed over the sequence number, packet length, padding length, payload, and random padding using the negotiated MAC algorithm (e.g., hmac-sha2-256).
If a packet's MAC does not verify, the receiver sends SSH_DISCONNECT_MAC_ERROR and closes the connection. Receiving a single MAC error is sufficient to terminate the session – there is no retry mechanism because the sequence number state is now unrecoverable.
Common non-malicious causes: network hardware corruption (bit flips on a faulty NIC or cable), NAT traversal devices that rewrite packet contents without updating the MAC, or memory errors causing payload corruption before the MAC check. Any man-in-the-middle that modifies SSH traffic without the session keys will trigger this.
Common Causes
- –Network hardware corruption (faulty NIC, cable, or switch) flipping bits in the payload
- –NAT or proxy device modifying SSH packet content after MAC is computed
- –Active MITM tampering with the encrypted SSH stream
- –Memory corruption on the sender corrupting the payload before transmission