Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does SSH send 100 packets per keystroke?

eieio.games

Post reply on HN
Print view View original

341–350 of 375 posts

Re: Why does SSH send 100 packets per keystroke?

#341

Post by JohnLeitch »

antonvs wrote: post #292
JohnLeitch wrote: post #216

Earlier quoted context omitted.

Sure, but that is aside from my original point. If somebody: a) Has the knowledge to run tcpdump or similar from the command line b) Has the ambition to document and publish their effort on the internet c) Has the ability identify and patch the target behaviors in code I argue that, had they not run to an LLM, they likely would have solved this problem more efficiently, and would have learned more along the way. Forg…

> I argue that, had they not run to an LLM, they likely would have solved this problem more efficiently This is just expert blindness, and objectively, measurably wrong.

Oh come on, the fact that the author was able to pull this off is surely indicative of some expertise. If the story started had started off with, "I asked the LLM how to capture network traffic," then yeah, what I said would not be applicable. But that's not how this was presented. tcpdump was used, profiling tools were mentioned, etc. It is not a stretch to expect somebody who develops networked applications knows a thing or two about protocol analysis.

Re: Why does SSH send 100 packets per keystroke?

#342

Post by JohnLeitch »

stackghost wrote: post #237
JohnLeitch wrote: post #216

Earlier quoted context omitted.

Sure, but that is aside from my original point. If somebody: a) Has the knowledge to run tcpdump or similar from the command line b) Has the ambition to document and publish their effort on the internet c) Has the ability identify and patch the target behaviors in code I argue that, had they not run to an LLM, they likely would have solved this problem more efficiently, and would have learned more along the way. Forg…

>I argue that, had they not run to an LLM, they likely would have solved this problem more efficiently Hard disagree. Asking an LLM is 1000% more efficient than reading docs, lots of which are poorly written and thus dense and time-consuming to wade through.

The problem is hallucinations. It's incredibly frustrating to have an LLM describe an API or piece of functionality that fulfills all requirements perfectly, only to find it was a hallucination. They are impressive sometimes though. Recently I had an issue with a regression in some of our test capabilities after a pivot to Microsoft Orleans. After trying everything I could think of, I asked Sonnet 4.5, and it came up with a solution to a problem I could not even find described on the internet, let alone solved. That was quite impressive, but I almost gave up on it because it hallucinated wildly before and after the workable solution.

The same stuff happens when summarizing documentation. In that regard, I would say that, at best, modern LLMs are only good for finding an entrypoint into the docs.

Re: Why does SSH send 100 packets per keystroke?

#343

Post by fsniper »

GuB-42 wrote: post #334

1980s: 1 packet per keystroke is too much, we must find a solution to bundle them together, for efficiency (see Nagle's algorithm, delayed ACK), also let's send everything in plaintext, including passwords 2020s: ha! with some advanced probabilistic models, we may be able to deduce something about what is being typed behind one of our layers of encryption, let's sent 100 packets per keystroke to mitigate that

Unfortunate result of the security theater.. "Someone who has access to run privileged application can run side channel attacks! Let's drop cpu performance 20 percent over the world"

Re: Why does SSH send 100 packets per keystroke?

#344

Post by MrDarcy »

JohnLeitch wrote: post #342
stackghost wrote: post #237

Earlier quoted context omitted.

>I argue that, had they not run to an LLM, they likely would have solved this problem more efficiently Hard disagree. Asking an LLM is 1000% more efficient than reading docs, lots of which are poorly written and thus dense and time-consuming to wade through.

The problem is hallucinations. It's incredibly frustrating to have an LLM describe an API or piece of functionality that fulfills all requirements perfectly, only to find it was a hallucination. They are impressive sometimes though. Recently I had an issue with a regression in some of our test capabilities after a pivot to Microsoft Orleans. After trying everything I could think of, I asked Sonnet 4.5, and it came up…

While my reply was snarky I am prepared to take a reasonable bet with a reasonable test case. And pay out.

Why I think I’d win the bet is I’m proficient with tcpdump and wireshark and I’m reasonably confident that running to a frontier model and dealing with any hallucinations is more efficient and faster than recalling the incantantions and parsing the output myself.

Re: Why does SSH send 100 packets per keystroke?

#345

Post by eieio »

JohnLeitch wrote: post #93

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

Hey! I'm the author.

My thinking was:

  * Yes, I clearly know what tcpdump is / how to capture network traffic
  * It has been several years since I have looked at a pcap
  * I don't have wireshark installed on this computer
  * I've done the thing where you decrypt TLS with wireshark exactly once, years ago, and I found it frustrating for reasons I can't remember[1]. Wasn't sure if I could do this with ssh
  * When I started investigating this, I didn't remotely think that ssh was the root cause. I thought it was a quirk of my game
  * I *did* make a client that printed out all the data it was receiving, but it was useless because it was operating at the wrong layer (e.g. it connected over SSH and logged the bytes SSH handed it)
  * I'm experimenting with Claude Code a lot because it has a lot of hype and I would like to form an opinion
  * Looking up flags is annoying
  * Being able to tell an agent "look at this pcap and tell me what you see" is *cool*
So idk. I'm sure that you would have solved this much more quickly than I did! I'm not sure that (for me) opening up the packet in Wireshark would have solved this faster. Maybe reading the SSH spec would have, but debugging also just didn't take that long.

And the big leap here was realizing that this was my SSH client and not a quirk of my game. The time at which I would have read the SSH spec was after I captured traffic from a regular SSH session and observed the same pattern; before that I was thinking about the problem wrong.

I don't think that this is unfortunate. In fact, I think I got what I wanted here (a better sense of Claude Code's strengths and weaknesses). You're right that an alternative approach would have taught me different things, and that's a worthy goal too.

[1] I suspect this is because I was doing it for an old job and I had to figure out how to run some application with keys I controlled? It would have been easier here. I don't remember.

Re: Why does SSH send 100 packets per keystroke?

#346

Post by MrDarcy »

stackghost wrote: post #172
JohnLeitch wrote: post #166

Earlier quoted context omitted.

What are you even trying to say? I suppose I'll clarify for you: Yes, I'm confident I could have identified the cause of the mysterious packets quickly. No, I'm not going to go through the motions because I have no particular inclination toward the work outside of banter on the internet. And what's more, it would be contrived since the answer has already shared.

I think the point they're making is that "I, a seasoned network security and red-team-type person, could have done this in Wireshark without AI assistance" is neither surprising nor interesting. That'd be like saying "I, an emergency room doctor, do not need AI assistance to interpret an EKG" Consider that your expertise is atypical.

The specific point I was trying to make was along the lines of, "I, a seasoned network security and red-team-type person, could have done this in Wireshark without AI assistance. And yet, I’d probably lose a bet on a race against someone like me using an LLM."

Re: Why does SSH send 100 packets per keystroke?

#347

Post by nyrikki »

davrosthedalek wrote: post #212
Jedd wrote: post #194

Earlier quoted context omitted.

> several 56k baud modems These were almost definitely 8k baud.

Yes, because at that time, a modem didn't actually talk to a modem over a switched analog line. Instead, line cards digitized the analog phone signal, the digital stream was then routed through the telecom network, and the converted back to analog. So the analog path was actually two short segments. The line cards digitized at 8kHz (enough for 4kHz analog bandwidth), using a logarithmic mapping (u-law? a-law?), and t…

An ISDN BRI (basic copper) actually had 2 64kbps b channels, for pots dialup as an ISP you typically had a PRI with 23 b, and 1 d channel.

56k only allowed one ad/da from provider to customer.

When I was troubleshooting clients, the problem was almost always on the customer side of the demarc with old two line or insane star junctions being the primary source.

You didn’t even get 33k on analog switches, but at least US West and GTE had isdn capable switches backed by at least DS# by the time the commercial internet took off. Lata tariffs in the US killed BRIs for the most part.

T1 CAS was still around but in channel CID etc… didn’t really work for their needs.

33.6k still depended on DS# backhaul, but you could be pots on both sides, 56k depended on only one analog conversion.

Re: Why does SSH send 100 packets per keystroke?

#348

Post by JohnLeitch »

eieio wrote: post #345
JohnLeitch wrote: post #93

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

Hey! I'm the author. My thinking was: * Yes, I clearly know what tcpdump is / how to capture network traffic * It has been several years since I have looked at a pcap * I don't have wireshark installed on this computer * I've done the thing where you decrypt TLS with wireshark exactly once, years ago, and I found it frustrating for reasons I can't remember[1]. Wasn't sure if I could do this with ssh * When I started…

Thanks for taking the time to respond, and apologies for the contentiousness. I'm a jaded old man suffering from severe LLM fatigue, so I may have come off a bit harsh. Your write-up was a good read, and while I might be critical of your methodology, what you did clearly worked, and that's what matters in the end. Best of luck with your project, especially the go lib fork.

Re: Why does SSH send 100 packets per keystroke?

#349

Post by Rebelgecko »

geocar wrote: post #302
Rebelgecko wrote: post #179

Earlier quoted context omitted.

Once upon a time I worked on a project where we SSH'd into a satellite for debugging and updates via your standard electronics hobbiest-tier 915mhz radio. Performance was not great but it worked and was cheap.

ELRS?

Nope this predated ELRS by a bit. I wasn't super involved with the RF stuff so not sure if we rolled our own or used an existing framework

Re: Why does SSH send 100 packets per keystroke?

#350

Post by eieio »

JohnLeitch wrote: post #348
eieio wrote: post #345

Earlier quoted context omitted.

Hey! I'm the author. My thinking was: * Yes, I clearly know what tcpdump is / how to capture network traffic * It has been several years since I have looked at a pcap * I don't have wireshark installed on this computer * I've done the thing where you decrypt TLS with wireshark exactly once, years ago, and I found it frustrating for reasons I can't remember[1]. Wasn't sure if I could do this with ssh * When I started…

Thanks for taking the time to respond, and apologies for the contentiousness. I'm a jaded old man suffering from severe LLM fatigue, so I may have come off a bit harsh. Your write-up was a good read, and while I might be critical of your methodology, what you did clearly worked, and that's what matters in the end. Best of luck with your project, especially the go lib fork.

Eh, I was a little annoyed at the comment last night but read through the thread again today and you were clearly engaging in good faith.

I totally get being exhausted at LLMs. And I don't mind the nudge to be a little less lazy and install wireshark for next time.

hope I get you to play the game when it's out!

Post reply on HN