Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am interested in the exact mechanism that occurs when an SSH tunnel is stablished.

Supposing we have 3 computers: LOCAL host, INTERMEDIATE host, and REMOTE host, with this topology:

Localhost --- INTERNET --- IntermediateHost --- LAN --- RemoteHost

And we want to pen a tunnel to a Web Server running on RemoteHost.

Intermediate and Remote hosts accept SSH connections.

When I execute the following command in the Local machine:

$ ssh -L 2022:remote:80 user@intermediate

Im I right if I assume the following?

  • The SSH client of localhost opens the port 2022 and listens to it (starting to act as a server)
  • In the same time, the SSH client of localhost opens an SSH connection with default port (22) on Intermediate host.
  • In this connection, the client informs the IntermediateHost that it wants to open a tunnel (since the SSH protocol supports it), so now the Intermediate SSH server knows that it has to send the traffic received throught this connection to the RemoteHost, port 80.

So now, a Web Browser running on Localhost connects to localhost:2022 and sends a "GET /" through the socket. The SO takes control and encapsulates this info inside a TCP packet, with destination port 2022, and then this one inside an IP packet, with destination address LOCALHOST, the routing tables of the operating system determine that the packet is meant for the same machine, so it unwraps the TCP packet, reads the destination, and unwraps it, returning the "GET /" to the serverSocket that the SSH client has opened before (on port 2022)

Is this correct? because as far as I know, a tunnel wraps the TCP/IP packet through SSH, but in this scenario, the SSH client doesn't have access to the TCP/IP packet, it only gets the "application level" information: "GET /".

Thank you!

share|improve this question

migrated from Oct 25 '12 at 12:21

This question came from our site for professional and enthusiast programmers.

what do you mean by "The SO"? As for "a tunnel wraps the". No.. Tunneling is smuggling/encapsulating one protocol inside another one, but the encapsulated is encrypted, and this allows the encapsulation to be a potentially untypical combination and flexible. A tunnel is I suppose the connection with tunneling going on. (i'm no fan of the terminology!) – barlop Mar 12 '13 at 10:38
up vote 2 down vote accepted

Your understanding of the process is correct.

The "wrapping" or "tunneling" indeed happens at TCP level: the stream coming over the SSH connection is connected to the socket connection in the LAN, and everything that goes forth and back over this also goes over that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.