Rapid re-connects via ssh

[Torsten Bronger]

Hallöchen!

Is the following behaviour known:

I open a file on a remote machine via ssh.  Then, tramp seems to
re-read the file multiple times per second (5 times approximately).
After a certain pause, this misbehaviour repeats.  The
/tmp/tramp.xxxxxxx files are written rapidly, too, with changing
names.

On the remote machine, sshd's log looks like this:

Aug 21 14:41:00 bob sshd[10893]: Accepted publickey for bronger from 
87.78.109.224 port 64253 ssh2
Aug 21 14:41:42 bob sshd[10900]: Accepted publickey for bronger from 
87.78.109.224 port 64258 ssh2
Aug 21 14:41:44 bob sshd[10905]: Accepted publickey for bronger from 
87.78.109.224 port 64259 ssh2
Aug 21 14:45:09 bob sshd[10925]: Accepted publickey for bronger from 
87.78.109.224 port 64260 ssh2
Aug 21 14:45:14 bob sshd[10930]: Accepted publickey for bronger from 
87.78.109.224 port 64261 ssh2
Aug 21 14:45:19 bob sshd[10935]: Accepted publickey for bronger from 
87.78.109.224 port 64262 ssh2
Aug 21 14:45:34 bob sshd[10946]: Accepted publickey for bronger from 
87.78.109.224 port 64263 ssh2
Aug 21 14:45:39 bob sshd[10952]: Accepted publickey for bronger from 
87.78.109.224 port 64264 ssh2
Aug 21 14:45:44 bob sshd[10963]: Accepted publickey for bronger from 
87.78.109.224 port 64265 ssh2
Aug 21 14:45:49 bob sshd[10968]: Accepted publickey for bronger from 
87.78.109.224 port 64266 ssh2
Aug 21 14:45:54 bob sshd[10973]: Accepted publickey for bronger from 
87.78.109.224 port 64267 ssh2
Aug 21 14:45:59 bob sshd[10978]: Accepted publickey for bronger from 
87.78.109.224 port 64268 ssh2
Aug 21 14:46:04 bob sshd[10983]: Accepted publickey for bronger from 
87.78.109.224 port 64274 ssh2
Aug 21 14:46:09 bob sshd[10988]: Accepted publickey for bronger from 
87.78.109.224 port 64275 ssh2
Aug 21 14:46:14 bob sshd[10993]: Accepted publickey for bronger from 
87.78.109.224 port 64277 ssh2
Aug 21 14:46:19 bob sshd[10998]: Accepted publickey for bronger from 
87.78.109.224 port 64278 ssh2
Aug 21 14:46:29 bob sshd[11011]: Accepted publickey for bronger from 
87.78.109.224 port 64279 ssh2
Aug 21 14:46:34 bob sshd[11017]: Accepted publickey for bronger from 
87.78.109.224 port 64280 ssh2
Aug 21 14:46:39 bob sshd[11028]: Accepted publickey for bronger from 
87.78.109.224 port 64281 ssh2
Aug 21 14:46:44 bob sshd[11033]: Accepted publickey for bronger from 
87.78.109.224 port 64282 ssh2
Aug 21 14:46:49 bob sshd[11038]: Accepted publickey for bronger from 
87.78.109.224 port 64283 ssh2
Aug 21 14:46:59 bob sshd[11049]: Accepted publickey for bronger from 
87.78.109.224 port 64284 ssh2
Aug 21 14:47:04 bob sshd[11054]: Accepted publickey for bronger from 
87.78.109.224 port 64285 ssh2
Aug 21 14:47:09 bob sshd[11059]: Accepted publickey for bronger from 
87.78.109.224 port 64286 ssh2

Thus, every five seconds in opens a new connection.  Possibly this
is the pause between those 5-groups.

I lost tramp's logfile because the firewall on my institution
suspected an ssh attack and blocked my machine 87.78.109.224
automatically.  So far, I was unable to reproduce it.

If it isn't known, I'll give a more detailed report when I see it
again.  (I *have* seen in already multiple times but couldn't see a
pattern so far.)

Tschö,
Torsten.

-- 
Torsten Bronger, aquisgrana, europa vetus
                   Jabber ID: address@hidden