Suspicious sshd log messages in my syslog

[Damien Miller]

On Thu, 3 Aug 2006, Logu wrote:

> Hello All,
> 
> I'm using OpenSSH 4.3p2. I'm getting few messages in my syslog and it is 
> shown below,
> 
> Aug 02 11:15:19 foo sshd[4381]: Received window adjust for non-open  channel 
> 0.
> 
> I found that sshd received a SSH_MSG_CHANNEL_WINDOW_ADJUST and it executes 
> the function channel_input_window_adjust() in channels.c. I like to know how 
> this can happen for a non-open channel. Is anything suspicious going in my 
> network?

No, it is harmless. What client are you using? I haven't seen these with
OpenSSH's ssh as the client, but have heard of them with other clients.

It is also conceivable that these can occur as a result of a race
condition between a channel closing at the server end while the client
still has data in the pipe and is sending window adjustments.

-d