Embed Notice

(There are MULTIPLE ways to get to this eventual understanding)

For some reason the 5th SSH session is dying early. Let's filter on the stream ID to isolate this individual TCP conversation. Yes there's a SYN then two repeats. Nothing is getting established from get-go. But what about the others?

Going back to our original black lines in Wireshark, those are the 4 different existing connections trying to re-transmit an ACK saying please continue sending. But they are never hearing back. So the APPLICATION is seemingly not dying, it is somewhere else. And no TCP tear-down.