I have ssh'd into a remote machine and on that machine run scp to copy files from another remote machine. I assumed that the files would be copied directly between the two remote machines but the speed of the transfer suggests that they are being copied via my local machine. Is this correct? Is it possible to avoid this?
According to wikipedia you are correct, it is routing through your conection:
Remote to remote mode In the past, in remote-to-remote secure copy, the SCP client opens an SSH connection to the source host and requests that it, in turn, open an SCP connection to the destination. (Remote-to-remote mode did not support opening two SCP connections and using the originating client as an intermediary). It is important to note that SCP cannot be used to remotely copy from the source to the destination when operating in password or keyboard-interactive authentication mode, as this would reveal the destination server's authentication credentials to the source. It is, however, possible with key-based or GSSAPI methods that do not require user input.
Recently, remote-to-remote mode supports routing traffic through the client which originated the transfer, even though it is a 3rd party to the transfer. This way, authorization credentials must reside only on the originating client, the 3rd party.
To do what you want, and avoid the 3rd party traffic routing, you need to set up ssh keys.
These days there are two possibilities how to copy files using
scp between two remote hosts:
Simple one works directly, but the drawback is that you need to authenticate from the
host2(using password, key stored on the
host1or forwarded ssh-agent):
scp host1:file host2:file
-3option adds possibility to authenticate directly from your host to both of the remote hosts (do not expose the authentication informations), but you go always through the local host and you lose most of the error messages, because of the implementation.
scp -3 host1:file host2:file
Even if you transfer data directly, you would not be able to cover all the bandwidth, unless you have HPN-SSH patch applied.