SSH_DISCONNECT_PROTOCOL_ERROR
SSH_DISCONNECT_PROTOCOL_ERROR (2) is sent when an SSH protocol violation is detected. One side sent a message that violates the SSH protocol state machine – an unexpected message type, a message in the wrong phase, or a malformed SSH packet. The connection is terminated immediately.
Code
2
Category
Disconnect
Standard
RFC 4253 §11.1
Description
SSH_DISCONNECT_PROTOCOL_ERROR covers any SSH protocol-level violation that does not have a more specific disconnect code. This includes: receiving a message type that is not valid in the current protocol phase, receiving a channel message for a non-existent channel, or a message that cannot be parsed according to SSH wire format.
This disconnect is distinct from authentication failures (which have their own error path) and key exchange failures (code 3). Protocol errors indicate a bug in the client or server SSH implementation, or an active network-level manipulation of the SSH stream.
Some SSH middleboxes and DPI (deep packet inspection) systems that attempt to inspect or modify SSH traffic can trigger code 2 by corrupting the SSH stream in ways that look like protocol violations to the endpoint.
Common Causes
- –Client sent an SSH message type not valid in the current state
- –Malformed SSH packet (invalid length, bad padding)
- –DPI or proxy corrupting the SSH stream
- –SSH implementation bug sending wrong message sequence
- –Channel message referencing an invalid or closed channel