openssh unix dev - Aug 2006 - Suspicious sshd log messages in my syslog

Hello All,

I'm using OpenSSH 4.3p2. I'm getting few messages in my syslog and it is
shown below,

Aug 02 11:15:19 foo sshd[4381]: Received window adjust for non-open  channel 
0.

I found that sshd received a SSH_MSG_CHANNEL_WINDOW_ADJUST and it executes 
the function channel_input_window_adjust() in channels.c. I like to know how 
this can happen for a non-open channel. Is anything suspicious going in my 
network?

Could anyone share the ideas?

Thanks,
-logu

On Thu, 3 Aug 2006, Logu wrote:
> Hello All,
> 
> I'm using OpenSSH 4.3p2. I'm getting few messages in my syslog and
it is
> shown below,
> 
> Aug 02 11:15:19 foo sshd[4381]: Received window adjust for non-open 
channel
> 0.
> 
> I found that sshd received a SSH_MSG_CHANNEL_WINDOW_ADJUST and it executes 
> the function channel_input_window_adjust() in channels.c. I like to know
how
> this can happen for a non-open channel. Is anything suspicious going in my 
> network?
No, it is harmless. What client are you using? I haven't seen these with
OpenSSH's ssh as the client, but have heard of them with other clients.

It is also conceivable that these can occur as a result of a race
condition between a channel closing at the server end while the client
still has data in the pipe and is sending window adjustments.

-d