ssh traffic

UNIX Solaris
1

i have 3 servers running at home. i always connect to these servers from a windows box via ssh. recently i was snooping my interface on my database server and saw a lot of ssh traffic. this is a few lines of the snoop:

   deathstar -> xstar        TCP D=22 S=3190 Ack=662538517 Seq=1676539194 Len=0 Win=65535
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662538517 Len=116 Win=49640
   deathstar -> xstar        TCP D=22 S=3190 Ack=662538633 Seq=1676539194 Len=0 Win=65419
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662538633 Len=148 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662538781 Len=244 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662539025 Len=132 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662539157 Len=244 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662539401 Len=228 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662539629 Len=340 Win=49640
   deathstar -> xstar        TCP D=22 S=3190 Ack=662539629 Seq=1676539194 Len=0 Win=64423
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662539969 Len=228 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662540197 Len=148 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662540345 Len=132 Win=49640
   deathstar -> xstar        TCP D=22 S=3190 Ack=662540477 Seq=1676539194 Len=0 Win=65535
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662540477 Len=244 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662540721 Len=148 Win=49640
       xstar -> deathstar    TCP D=3190 S=22 Push Ack=1676539194 Seq=662540869 Len=244 Win=49640

deathstar is my winxp box and xstar is my db server. i've looked around and found that there maybe something with my windows xp gigabyte interface not buffering. is this normal ssh traffic? i've never seen this before. thoughts?

2

I see nothing strange there... it's probably just the traffic in the session you were using to run the snoop? Which part of it do you think is remarkable?

3

i use snoop on a daily basis at work. i never see this traffic. it could also be that there is so much other types of traffic that i dont realize this ssh traffic or pay attention to it. i'm usually not looking for ssh traffic.