Skip to main content
protocols.pageprotocols.page
12

SSH_DISCONNECT_TOO_MANY_CONNECTIONS

DisconnectRFC 4253 §11.1

SSH_DISCONNECT_TOO_MANY_CONNECTIONS (12) is sent by the server when it has reached its maximum concurrent connection limit. The server accepted the TCP connection but cannot service a new SSH session. The client should retry after a delay. Equivalent to an HTTP 503 at the SSH layer.

Code

12

Category

Disconnect

Standard

RFC 4253 §11.1

Description

SSH servers implement connection limits to prevent resource exhaustion. OpenSSH's MaxStartups directive controls how many unauthenticated SSH connections the server will accept simultaneously. When this limit is reached, new connections are dropped or rejected with disconnect code 12.

MaxStartups format is start:rate:full where start is the number of connections at which the server starts probabilistically dropping new connections, rate is the probability of dropping (percent), and full is the hard maximum at which all new connections are dropped.

Code 12 disconnects appear during SSH scanning attacks (many connections overwhelming MaxStartups), misconfigured connection pools opening too many parallel SSH sessions, or automation that creates SSH connections faster than they are being closed.

Common Causes

  • –SSH server MaxStartups limit reached (too many unauthenticated connections)
  • –SSH scanning attack overwhelming the server's connection accept queue
  • –Connection pool opening too many parallel SSH sessions simultaneously
  • –Server process table full (too many sshd child processes)
RFC 4253 – SSH specification →