SSH Packet Format

Following image shows the SSH packet format as explained by RFC 4253. Please refer page number 7 and 8 of RFC 4253 to get more clear picture about SSH packet format.

Descriptions given below are copied from RFC 4253

Packet Length : Packet Length is length of the packet in bytes, not including HMAC value or the Packet Length field itself.

Padding Length : Padding Length is the length of Random Padding in bytes.

Payload : Payload is the useful contents of the packet. If compression has been negotiated, this field is compressed.

Random Padding : Random Padding is the arbitrary-length padding, such that the total length of (packet_length || padding_length || payload || random padding) is a multiple of the cipher block size or 8, whichever is larger. There MUST be at least four bytes of padding. The padding SHOULD consist of random bytes. The maximum amount of padding is 255 bytes.

MAC (Message Authentication Code) : MAC (Message Authentication Code) field contains the MAC value, if the message authentication has been negotiated, this field contains the MAC bytes. Initially, the MAC algorithm MUST be "none".

SSH Captured Packet screenshot

Following image shows the screenshot a Wireshark captured packet of SSH. Note that Encrypted Packet Length, Encrypted Packet and HMAC are the three fields. The contents of Padding, Payload and Random Padding are inside the Encrypted packet field.