“Write failed: Connection reset by peer” means your SSH connection was forcibly terminated while the client was sending data. It is an observation, not a diagnosis. The peer may be sshd, a firewall, NAT device, VPN, load balancer, or another part of the network path. The fastest fix is to identify when the reset occurs, then match the client’s verbose output with server logs at the same timestamp.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the error actually means
SSH runs over a TCP connection. When the local SSH process writes to that socket and receives a TCP reset or abort, OpenSSH reports Write failed: Connection reset by peer. “Peer” does not necessarily mean the remote computer intentionally rejected your command. It means that the connection disappeared from the client’s point of view.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The reset can be generated by the remote SSH daemon, a host firewall, an intermediate firewall or NAT gateway, a VPN, a load balancer, or a broken network path. A keepalive sequence can also end with this message: after enough unanswered probes, the sender concludes that the other side is unreachable and closes the connection.
Do not treat this message as a timeout diagnosis. A timeout usually means no response arrived before a timer expired. A reset means the socket was actively aborted. The distinction is useful, but it still does not identify which device sent the reset.
#1 Best Overall
Use the failure phase to narrow the cause
| When the reset occurs | More likely areas to investigate | First useful evidence |
|---|---|---|
| Before authentication or during key exchange | sshd crash, package defect, host policy, authentication limits, security tooling, malformed negotiation | Last 30–50 lines of ssh -vvv; sshd journal; service and kernel events |
| Immediately after login | Shell or forced-command failure, account policy, session setup, PAM or security controls | Authentication and session logs; command run without shell startup files |
| After hours of activity | NAT, VPN, firewall idle limits, route changes, host sleep, daemon restart | Keepalive timing; network-path comparison; restart and firewall logs |
| Only from one client or network | Local firewall, client configuration, IPv4/IPv6 path, VPN or access network | Same command from another network and with -4/-6 |
| For many clients at once | Connection pressure, MaxStartups, rate limiting, overloaded host or security appliance |
Concurrent pre-auth connections, sshd logs, resource and firewall statistics |
A repeatable reset during key exchange deserves urgent server-side investigation. A disconnect after a long idle period points first toward liveness and path behavior. These are working hypotheses, not proof; confirm them with logs and packet direction.
Step 1: capture a useful client trace
- Run the connection with maximum normal OpenSSH verbosity:
ssh -vvv user@host. - Save the final 30–50 lines, including the last key-exchange, authentication, or keepalive message.
- Record the exact UTC or local timestamp, destination address, client network, and whether the session was idle.
- Repeat once, if safe, without changing several settings at the same time. A reproducible phase is more valuable than a collection of guesses.
Look for the last successful event. Messages mentioning key exchange, SSH2_MSG_KEX, authentication, channel opening, or server-alive probes place the failure in different parts of the connection lifecycle. The client trace tells you what the client observed; it does not prove which machine sent the reset.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Step 2: correlate the server at the same timestamp
systemd-based distributions
Check the service status and recent journal entries:
systemctl status sshd
journalctl -u sshd --since "10 minutes ago"
Some distributions name the unit ssh rather than sshd, so use the service name configured by that distribution.
Traditional log files
Inspect /var/log/auth.log on systems that use Debian-style logging or /var/log/secure on systems that use the Red Hat-style path. Search the failure window for fatal, preauth, authentication-limit messages, daemon restarts, firewall denials, segmentation faults, and clean administrative stops.
Rank #2
Kernel, memory, and restart evidence
A daemon can vanish without leaving a clear SSH message. Check kernel logs for an OOM-killer event, segmentation fault, or other process termination; check whether a service manager restarted sshd; and inspect configured core-dump records where available. A restart at the same second as the client reset is stronger evidence than the client error alone.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCorrelate by timestamp rather than assuming that every “broken pipe” or reset line represents deliberate action by the administrator. The socket event is the symptom; the surrounding records identify the actor.
Step 3: test for an sshd crash or package defect
If the connection resets consistently during key exchange, treat an unhealthy daemon or host as a primary suspect. Verify the installed package version, recent upgrades or downgrades, service restarts, and core dumps. A documented failure mode has sshd reaching SSH2_MSG_KEX_ECDH_REPLY, then dying; the client consequently reports the same write-reset message. Such defects are fixed by moving to the vendor’s corrected package, not by increasing a timeout.
For a controlled reproduction, OpenSSH developers recommend collecting both sides’ debug output. You can run a separate foreground test daemon on an isolated, temporary port:
sshd -ddd -e -p 2222Connect to that port from a test client and keep the normal production daemon untouched. Do not replace the active daemon with a debug process, expose a debug listener to the public internet, or leave verbose secrets in shared logs. Stop the temporary process after the test and remove any temporary configuration.
Recommended Free Tools
Rank #3
- Used Book in Good Condition
Step 4: check unauthenticated connection pressure
MaxStartups limits concurrent unauthenticated connections. When a server is receiving many parallel handshakes, additional connections can be dropped. OpenBSD’s current default is 10:30:100: up to 10 unauthenticated connections are allowed without random refusal, then refusal probability rises until 100 concurrent connections, at which point new connections are refused.
Read the effective setting rather than relying on a file that may be overridden:
sshd -T | grep -i maxstartupsInspect half-open TCP connections and correlate them with authentication logs:
ss -tn state syn-recv sport = :22Also look for a large pre-auth population in sshd logs, scans, connection bursts, CPU or memory exhaustion, and firewall rate-limit events. A higher limit is appropriate only when legitimate parallel clients are being rejected and the host has capacity. Pair any increase with connection rate limiting, source controls, and abuse monitoring; otherwise you may make a denial-of-service problem easier.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsStep 5: investigate the network path and middleboxes
Compare networks and address families
Try the same destination from a second client network, such as a different trusted access connection. If permitted, compare address families explicitly:
ssh -4 user@host
ssh -6 user@hostA failure on only IPv6, only a VPN, or only one access provider points to a path-specific problem rather than a universal sshd failure.
Review stateful devices
Check host and perimeter firewall rules, NAT mapping lifetimes, VPN tunnel stability, load-balancer idle-flow policies, and any intrusion-prevention device that inspects SSH handshakes. A device may intentionally send a reset when a policy is violated, when an idle mapping expires, or when the backend is considered unhealthy.
Determine who sent the reset
If you are authorized to capture traffic, take a narrowly scoped capture at both endpoints or at the nearest controlled network points. Compare packet direction and timestamps: a TCP RST from the server host, a gateway address, and the client-side stack lead to different owners and fixes. Capture only the affected flow, protect the file because SSH metadata may be sensitive, and stop once the phase is established.
Step 6: configure keepalives only for a demonstrated liveness problem
SSH protocol keepalives make an idle or unreachable path fail predictably. They do not repair a crashed daemon, an authentication rejection, a blocked port, or a firewall that discards every SSH packet.
Client-side settings
Put a host-specific block in the client configuration, normally ~/.ssh/config:
Host example
ServerAliveInterval 30
ServerAliveCountMax 3ServerAliveInterval sends an encrypted-channel probe after the connection has been idle for the specified number of seconds. ServerAliveCountMax controls how many unanswered probes are tolerated. With a 15-second interval and the default count of 3, the client disconnects after approximately 45 seconds of unresponsiveness, subject to scheduling and network timing. A 30-second interval with count 3 is a policy choice, not a universal best value.
Use a host block instead of changing every destination globally. Confirm the effective values with:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →ssh -G user@host | grep -i serveraliveServer-side settings
The corresponding sshd controls are ClientAliveInterval and ClientAliveCountMax. They let the server test whether an authenticated client still responds. Change them deliberately, validate the configuration, and reload rather than abruptly terminating active sessions:
sshd -t
systemctl reload sshdKeepalive traffic can prevent some idle NAT and firewall expirations, but it also creates periodic traffic and may conflict with a security policy. Choose an interval longer than ordinary scheduling jitter and shorter than the known idle timeout of the path you need to preserve.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use a cause matrix instead of changing settings at random
| Observed pattern | Most efficient next test | Interpretation if confirmed |
|---|---|---|
| Every attempt resets at the same key-exchange message | Check sshd crash, package history, kernel logs, and isolated sshd -ddd -e reproduction |
Daemon health, software defect, or pre-auth security policy |
| Only bursts of parallel logins fail | Inspect effective MaxStartups, pre-auth counts, and rate-limit logs |
Connection pressure or defensive throttling |
| Only long-idle sessions fail | Measure idle duration; review NAT/VPN/firewall timers; test keepalives | Path liveness or state expiration |
| Only one network or address family fails | Repeat from another network and with -4/-6 |
Client path, provider, VPN, or IPv6/IPv4-specific issue |
| Many clients fail simultaneously | Check daemon restarts, host resources, gateway events, and packet-reset source | Shared server or network infrastructure event |
Common fixes that do not solve this error
- Blindly increasing timeouts: this does nothing when sshd is crashing or a firewall is actively resetting the flow.
- Adding keepalives to a pre-authentication failure: keepalives apply after a session is established; they cannot make a broken key exchange succeed.
- Raising
MaxStartupswithout evidence: it can increase resource exposure and hide an abuse or scanning problem. - Assuming “peer” means the remote host: a gateway or VPN endpoint may have generated the reset.
- Changing several variables at once: you lose the failure pattern needed to distinguish software, policy, and path causes.
- Running a debug daemon on the production port: this can interrupt legitimate users and expose sensitive diagnostic output.
When to escalate
Escalate to the server or network owner with the exact timestamp, destination address, client address, failure phase, final verbose lines, relevant sshd journal entries, service and kernel events, and whether another network reproduces the problem. Include packet-capture evidence only through an approved channel. This bundle lets an administrator decide whether to patch or restart sshd, adjust connection limits, correct a firewall or NAT policy, or repair the underlying route without guessing.
For a game-server administrator, the same method applies whether SSH is used for deployment, log collection, or emergency maintenance: preserve the game service, use an isolated diagnostic port when possible, and make configuration changes only after the phase and scope of the reset are established.
Quick Recap
Practical decision checklist
- Did the reset happen during key exchange, authentication, immediately after login, or after an idle period?
- What is the final line in
ssh -vvv, and what exact timestamp does it carry? - Do
journalctl -u sshd,/var/log/auth.log, or/var/log/secureshow a crash, restart, limit, denial, or clean stop? - Is the effective
MaxStartupssetting consistent with the number of simultaneous unauthenticated clients? - Does the behavior change from another network or with
ssh -4versusssh -6? - Which device sent the TCP reset, if a permitted packet capture can establish it?
- Would host-specific keepalives address a measured idle-path failure, or would they merely mask an unrelated daemon or policy defect?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
