If an SSH terminal becomes unresponsive only after you stop typing, the most likely cause is an idle TCP connection being discarded by a NAT gateway, firewall, VPN, or other packet-filtering device. Your terminal can still look open locally even though the network path has forgotten the connection. Enable SSH-level keepalives, then investigate the network or host if probes go unanswered. A freeze that occurs while you are actively typing, during a file transfer, or immediately at login points to a different problem and needs a different diagnosis.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Classify the freeze before changing settings
The timing of the failure is the fastest way to narrow the cause. Reproduce it once and record exactly what you were doing when input stopped echoing. Do not assume every SSH hang is an idle-timeout problem.
As an Amazon Associate I earn from qualifying purchases.
It fails after a repeatable idle period
An idle-only failure strongly suggests that an intermediary expired its state table. Home routers, corporate firewalls, cloud security appliances, VPN concentrators, and cellular gateways commonly remove quiet TCP sessions after a period that may be only a few minutes. The OpenSSH FAQ describes this as the usual result of a packet filter or NAT device timing out a TCP connection because of inactivity. NASA guidance likewise warns that NAT tables can disappear after only a few minutes and recommends a client-side ServerAliveInterval.
It fails while you are typing or transferring data
An active-session failure is less consistent with an idle middlebox timeout. Check Wi-Fi loss, a changing VPN route, packet loss, an MTU or fragmentation problem, firewall interference, CPU or memory pressure on either endpoint, and whether the remote shell or kernel is stalled. Keepalives can reveal that a path is dead, but they cannot repair any of those conditions.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
It hangs immediately at login
If the pause occurs during DNS lookup, TCP connection, host-key exchange, authentication, or channel setup, inspect that stage rather than adding an idle probe. Authentication backends, name-service lookups, host-key prompts, overloaded servers, and blocked ports can all look like a frozen terminal. Verbose SSH output shows which phase stopped.
It dies during a long transfer
A transfer that stops while packets are flowing may indicate congestion, packet loss, a route change, a VPN issue, disk or CPU saturation, or a stalled process. Capture the exact error and compare it with client and server logs. An idle keepalive setting is not a throughput or congestion-control fix.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What is happening when the terminal appears frozen?
SSH carries an interactive shell inside an encrypted connection, which itself uses TCP. NAT and firewall devices track TCP flows in state tables. When no packets cross a flow for long enough, an intermediary may delete that entry. Both endpoints can still believe the socket exists, so the local terminal remains open and keystrokes may appear to do nothing. The next packet then has no valid state to follow and may be dropped or rejected.
Other failures produce similar symptoms. A laptop can suspend its Wi-Fi adapter, a VPN can silently discard a route, or the remote host can run out of memory and stop scheduling the SSH process. A dead route, crashed host, or broken tunnel may eventually produce broken pipe, connection reset, or connection timed out. Preserve the exact message: it helps distinguish a clean SSH decision from a transport failure.
Use verbose logging and a one-off keepalive test
Start a new connection rather than trying to diagnose a terminal that is already stuck. The -vvv option enables maximum client-side diagnostic output:
ssh -vvv user@example-hostWatch whether output stops during name resolution, TCP connection, authentication, channel creation, or an established idle session. In an idle test, run a command that waits, such as sleep 300, and leave the connection untouched long enough to reproduce the problem. Compare the elapsed time with the usual freeze interval.
Recommended Free Tools
To test SSH-level probes without editing any files, use command-line options:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=3 user@example-hostThis sends an encrypted SSH-level alive request every 30 seconds and disconnects after three unanswered requests. The approximately 90-second bound applies only if all three probes go unanswered and the connection reaches that timing sequence; it is not a promise that every network failure will be detected at exactly 90 seconds. Choose an interval shorter than the suspected NAT or firewall timeout. Thirty seconds is a test value, not a universal best setting.
Configure the client with ServerAliveInterval
The client option belongs in the account that initiates the connection. Open or create ~/.ssh/config, protect it as a private configuration file, and add a host-specific block:
Host example
HostName example-host
User your-user
ServerAliveInterval 30
ServerAliveCountMax 3Connect with ssh example to use the block. A host pattern such as Host * applies the setting to every destination, so prefer a named host or a carefully chosen pattern when only one network needs the workaround. If several blocks match, OpenSSH uses the first obtained value for a parameter; place specific patterns before broad ones.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the two client values mean
ServerAliveIntervalis the number of seconds between encrypted SSH-level probes when no response has been received from the server. The OpenSSH client manual lists a default of0, meaning no SSH-level probes are sent by default.ServerAliveCountMaxlimits consecutive unanswered probes before the client disconnects. Its documented default is3.
With ServerAliveInterval 15 and the default count of 3, the documented behavior is a disconnect after approximately 45 seconds without a response. The actual elapsed time can vary slightly with scheduling and packet timing. Lowering the interval detects failure sooner and keeps some middleboxes from classifying the flow as idle, but it creates additional traffic and can wake a battery-powered device more often.
Why SSH-level probes are useful
The probes travel through the encrypted SSH channel, so they test the SSH connection rather than merely asking whether a TCP socket still exists. The OpenSSH ssh_config(5) manual describes the server-alive mechanism as valuable when either side needs to know that a connection has become unresponsive. Because the messages are part of the authenticated SSH protocol, an unrelated device cannot successfully spoof a valid SSH response.
Configure the server with ClientAliveInterval
If you administer the remote host, the server can perform the complementary check. Edit the system’s sshd_config and add or adjust:
ClientAliveInterval 30
ClientAliveCountMax 3ClientAliveInterval is the interval at which sshd sends an encrypted alive request when the client has been inactive. ClientAliveCountMax sets how many consecutive unanswered requests are tolerated. The documented defaults are an interval of 0 and a count of 3; with an interval of 15 seconds and the default count, an unresponsive client is disconnected after approximately 45 seconds.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Server settings affect clients connected to that daemon, so changing them requires administrator access and should be coordinated with users. They are especially useful for releasing sessions whose laptops have been suspended or whose network paths disappeared. They do not prevent a middlebox from expiring an idle flow unless probes are sent frequently enough to refresh that device’s state.
Validate before reloading
- Back up the existing configuration and edit the active file used by the daemon.
- Run the platform’s OpenSSH configuration test mode, commonly
sshd -t. Fix every reported error before applying the change. - Reload the SSH service with the operating system’s documented service manager, for example
sudo systemctl reload sshdor the service name used by that distribution. Some systems call the unitssh; use the name installed on your host. - Keep an existing administrative session open while testing a new login. Do not close your only working connection until the new configuration has been verified.
A reload normally lets existing sessions continue while new settings apply to subsequent connections. If your platform does not support a safe reload, follow its service documentation and plan a maintenance window.
TCPKeepAlive is not the same as ServerAlive or ClientAlive
OpenSSH also exposes TCPKeepAlive, which uses the operating system’s TCP keepalive mechanism. It can help detect a dead route or a crashed peer, and it is enabled by default in the documented OpenSSH configurations. It operates below SSH encryption, however, and its timing is controlled largely by the operating system. It is therefore a different control from SSH-level alive messages.
| Setting | Where it is configured | Detection layer | Typical purpose | Failure behavior |
|---|---|---|---|---|
ServerAliveInterval and ServerAliveCountMax |
Client ~/.ssh/config or ssh -o |
Authenticated SSH protocol inside the encrypted channel | Keep an idle path active and detect an unresponsive server | Client disconnects after the configured unanswered-probe count |
ClientAliveInterval and ClientAliveCountMax |
Administrator’s sshd_config |
Authenticated SSH protocol inside the encrypted channel | Let the server detect an unresponsive client and clean up sessions | Server disconnects after the configured unanswered-probe count |
TCPKeepAlive |
Client or server OpenSSH configuration | TCP transport | Detect a dead route or crashed endpoint using kernel TCP keepalives | Depends on the operating system’s TCP keepalive timers and retransmission behavior |
Do not substitute TCPKeepAlive for SSH-level probes when your specific problem is an idle NAT or firewall timeout. Conversely, adding SSH probes will not revive a route that is down or a host that has crashed. The mechanisms can coexist because they test different layers.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose an interval that fits the network path
The correct interval is shorter than the shortest idle timeout on the path, but the timeout is often unknown. Start with a moderate value such as 30 seconds for a controlled test, then adjust based on observations from firewall, VPN, or NAT logs. If the device expires sessions after five minutes, a 60-second probe may be sufficient; if it expires them after one minute, 30 seconds provides more margin. These examples illustrate the decision, not a guarantee for a particular appliance.
- Shorter interval: more likely to keep a state table alive and detect a dead path quickly, at the cost of more packets and wakeups.
- Longer interval: less traffic and battery impact, but greater risk that an intermediary expires the flow first and a longer wait before a dead session is declared.
- Higher count: tolerates brief packet loss but leaves dead sessions around longer.
- Lower count: frees resources quickly but can disconnect during a short outage.
Keep the interval and count consistent with the user’s tolerance for interruption. A shell used for an interactive deployment may need fast failure detection; a background administrative session may prefer to tolerate a short Wi-Fi interruption.
What to check when keepalives do not help
If the test command still freezes or disconnects despite probes, treat the unanswered probe as evidence of a broken path or endpoint, not as a configuration failure by itself.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Compare both ends at the same timestamp
- Review the SSH client’s verbose output around the first missed response.
- Check the server’s SSH authentication and system logs for connection resets, resource errors, or daemon messages.
- Look at VPN and firewall logs for tunnel renegotiation, policy drops, idle-session expiry, or route changes.
- Inspect NAT state and idle timers when you administer the gateway.
Matching timestamps can show whether the server received a probe, whether it sent a response, and where the packet disappeared. If the client reports missed responses while the server shows no incoming request, investigate the network between them. If the server receives requests but cannot respond promptly, inspect host load and the SSH process.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Check the local network and VPN
Test from a different network, such as a wired connection or another trusted access path, if policy permits. A failure that follows one Wi-Fi network points toward its access point, firewall, or upstream NAT. A failure that follows the laptop points toward its Wi-Fi driver, sleep behavior, local firewall, or VPN client. Reconnect the VPN only as a diagnostic step; if reconnecting consistently restores access, inspect the tunnel’s logs and idle policy rather than relying on repeated manual reconnects.
Investigate MTU and packet loss for active failures
When typing, interactive programs, or transfers fail while traffic is active, examine packet loss, route changes, and path MTU behavior. A VPN can reduce the usable packet size, and an incorrect MTU can cause larger packets to be dropped while small probes appear to work. Keepalive success therefore does not prove that every application packet can traverse the path.
Check the remote host
Use an out-of-band console or another session to inspect CPU, memory, disk pressure, and kernel messages. A shell may stop responding because the host is swapping heavily, the filesystem is full, or the process has been blocked. If only one command hangs, the SSH transport may be healthy while that command waits on a lock, disk, or remote service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Interpreting common errors
Broken pipe
A broken-pipe message means the client tried to write to a connection that the operating system considered closed. The peer, a middlebox, or the local kernel may have closed it. Correlate the message with the idle duration and verbose output; do not treat it as proof that the remote shell intentionally exited.
Free tools Windows power users keep installed
One-click scans. No signup required.
Connection reset by peer
A reset indicates that a TCP endpoint or an intermediary actively rejected the connection. Check server logs, firewall policy, VPN events, and whether the daemon restarted. An SSH-level keepalive cannot prevent a deliberate reset.
Connection timed out
A timeout usually means no response arrived before the relevant TCP or SSH timer expired. Verify routing, port access, VPN reachability, and host availability. If the timeout happens only after idleness, compare it with the configured alive interval and the suspected middlebox timer.
Input appears ignored but the session later recovers
This can be a temporary packet-loss or congestion episode rather than a permanent disconnect. Wait for the configured probe and count behavior, then inspect logs. Increasing the count may avoid unnecessary disconnects during brief loss, but it should not conceal a recurring network problem.
Use host-specific policy instead of a risky global change
Different destinations can cross different firewalls and have different operational requirements. Keep a per-host block for a server reached through a short-idle VPN, and leave unrelated destinations at their defaults unless you have a reason to change them. A broad Host * rule can unintentionally add traffic to every SSH connection, including local or highly metered links.
After editing the client file, verify the effective values for a host:
ssh -G example | grep -E 'serveraliveinterval|serveralivecountmax|tcpkeepalive'The generated output shows what the client will use after matching all configuration files and command-line options. If the result is not what you expect, look for an earlier matching host block or a system-wide configuration that supplies the first value.
Keepalive settings and security
Alive probes do not authenticate a user or grant access; they operate within an already authenticated SSH connection. They do create periodic traffic, which may matter on metered links and may reveal that a session remains active to devices that can already observe the connection. Use the smallest interval that reliably avoids the known idle timeout, and avoid setting an extremely low interval across all hosts without an operational reason.
Server-side counts also affect resource cleanup. A server that waits indefinitely for disconnected clients can accumulate abandoned sessions, while an aggressive count can remove users during short outages. Choose values with the server’s capacity and users’ recovery expectations in mind.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
A repeatable troubleshooting procedure
- Record the symptom: note whether the failure follows inactivity, active use, login, or transfer, and preserve any exact error text.
- Measure the idle period: reproduce with a clock and identify whether the interval is consistent.
- Capture diagnostics: run
ssh -vvv user@example-hostin a fresh connection and save the relevant output. - Run a one-off probe test: try
ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=3 user@example-host, changing the interval when you have evidence of a different middlebox timer. - Persist only the needed client rule: place the values in a named
Hostblock in~/.ssh/config. - Configure the server when appropriate: set
ClientAliveIntervalandClientAliveCountMaxinsshd_config, validate with the daemon’s test mode, and reload safely. - Correlate both ends: compare client output, server logs, VPN and firewall events, NAT timers, and host-resource metrics at the same time.
- Address the underlying fault: repair Wi-Fi, routing, VPN, MTU, firewall policy, host load, or the stalled process instead of increasing keepalive traffic indefinitely.
Practical checklist
- Idle-only freeze: suspect NAT, firewall, VPN, or packet-filter state expiry first.
- Active-use freeze: investigate loss, MTU, route changes, endpoint load, and the SSH process.
- Client ownership: use
ServerAliveIntervalandServerAliveCountMaxin~/.ssh/config. - Server ownership: use
ClientAliveIntervalandClientAliveCountMaxinsshd_config. - Transport detection: remember that
TCPKeepAliveis separate from encrypted SSH alive messages. - Defaults: OpenSSH documents an SSH-level interval of 0 and a count of 3; an interval of 15 seconds with count 3 yields an approximately 45-second unanswered-probe bound.
- Validation: test the daemon configuration before reload and keep an existing administrative session open during changes.
- Evidence: retain the exact error and timestamps so network and system logs can be compared.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
