How to fix banner exchange: Connection to hostname port 22: Software caused connection abort in SSH

SSHINTERMEDIATEHIGHUpdated Jan 4, 2026· 500 views

This error occurs when the SSH client cannot complete the initial banner exchange with the server due to network interruption, firewall blocking, or server misconfiguration. It typically means the connection was closed unexpectedly during the protocol identification phase.

Quick fix

Fixes banner exchange: Connection to hostname port 22: Software caused connection abort

ssh -vvv user@hostname
  1. Enable verbose SSH debugging to identify where connection fails
  2. Verify the SSH server is running and accessible
  3. Temporarily disable local firewall to rule it out
  4. Check and disable third-party antivirus or security software
ssh — error
ssh -vvv user@hostname
banner exchange: Connection to hostname port 22: Software caused connection abort

What this error means

The SSH banner exchange is the initial handshake where the client and server identify themselves to each other. When you see "Software caused connection abort" during banner exchange, it means either your system or network infrastructure (firewall, antivirus, proxy, etc.) is actively terminating the connection before the SSH protocol can be fully established. This differs from a simple timeout or refused connection—the connection is being initiated but then abruptly closed by some software on your system or network path. The most common culprits are firewalls, antivirus software, network proxies, or misconfigured SSH server settings.

Typical symptoms

  • SSH command hangs then fails with the banner exchange error
  • Connection appears to establish briefly then immediately closes
  • Works fine from one network but fails from another
  • Error occurs consistently or intermittently without clear pattern
  • git clone, SCP, or any SSH-based tool fails with this error

Common causes

  1. Firewall (Windows Firewall, iptables, ufw, firewalld) is blocking or interrupting SSH traffic
  2. Third-party antivirus or security software terminating the connection mid-handshake
  3. Network proxy or intercepting tool interfering with SSH protocol negotiation
  4. SSH server daemon (sshd) crashed or stopped responding during banner exchange
  5. Network route dropped after initial SYN-ACK but before data exchange completes
  6. SSH server configuration issue (MaxStartups exceeded, reverse DNS lookup timeout)
  7. High network latency causing timeout during protocol identification phase
  8. Incompatible SSH protocol versions or key exchange algorithms being negotiated

How to fix "banner exchange: Connection to hostname port 22: Software caused connection abort"

1Enable verbose SSH debugging to identify where connection fails

First, gather detailed connection information by running SSH with maximum verbosity:

bash
ssh -vvv user@hostname

This will show exactly where in the banner exchange the connection is terminated. Look for lines like:
- debug1: Local version string: OpenSSH_... - your client sent its version
- debug1: Remote protocol version ... - server sent its version back
- If you see the first line but not the second, the server isn't responding

Save the full output—it will help diagnose the exact cause.

2Verify the SSH server is running and accessible

From a Linux/macOS terminal, confirm the SSH port is actually listening:

bash
# From your local machine, check if port 22 is open
nc -zv hostname 22
# or
telnet hostname 22

If this times out or is refused, the server isn't accepting connections. On the remote server, verify SSH is running:

bash
sudo systemctl status ssh    # Debian/Ubuntu
sudo systemctl status sshd   # RHEL/CentOS
ps aux | grep sshd

If SSH isn't running, start it:

bash
sudo systemctl start ssh     # Debian/Ubuntu
sudo systemctl start sshd    # RHEL/CentOS
3Temporarily disable local firewall to rule it out

The most common cause of "software caused connection abort" is your local firewall terminating the connection. Try disabling it temporarily:

Windows (as Administrator):

powershell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled $false

Then attempt the connection. If it works, re-enable and add an SSH exception:

powershell
netsh advfirewall firewall add rule name="SSH" dir=out action=allow protocol=TCP remoteport=22
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled $true

Linux (UFW):

bash
sudo ufw disable
# Test connection
ssh user@hostname
sudo ufw enable
# Add SSH rule
sudo ufw allow 22/tcp

Linux (firewalld):

bash
sudo firewall-cmd --permanent --add-port=22/tcp
sudo firewall-cmd --reload
4Check and disable third-party antivirus or security software

If firewall isn't the issue, third-party antivirus or security software may be intercepting SSH traffic. Temporarily disable (not just exit—fully disable) any of:
- Norton, McAfee, Kaspersky, ESET, Avast
- Third-party VPN clients
- Network monitoring tools
- Corporate proxy software

After disabling, retry the SSH connection. If it works, add SSH to the exception/whitelist list for that software.

Recommendation: On development machines, use only the built-in firewall and antivirus (Windows Defender, macOS Security, Linux ufw/firewalld).

5Increase SSH connection timeout

If your network has high latency or the server is slow during startup, increase the timeout:

bash
ssh -o ConnectTimeout=60 user@hostname

This gives the banner exchange 60 seconds instead of the default 30. To make this permanent, add to ~/.ssh/config:

bash
Host hostname
  ConnectTimeout 60
6Restart SSH daemon and check for config errors

If you have server access, restart SSH and check for configuration issues:

bash
# Check for syntax errors
sudo sshd -t

# If errors appear, fix them in /etc/ssh/sshd_config
# Common issues:
# - MaxStartups too low (default 10:30:100 may be too restrictive)
# - UseDNS yes causing long reverse lookups

# Restart SSH
sudo systemctl restart ssh

# Check if port is listening
netstat -tuln | grep :22
# or
ss -tuln | grep :22

If you see DNS-related delays in logs, add to /etc/ssh/sshd_config:

bash
UseDNS no
7Check server logs for connection details

Review the SSH server logs for errors during connection attempts:

bash
# Recent connections and errors
tail -50 /var/log/auth.log        # Debian/Ubuntu
tail -50 /var/log/secure          # RHEL/CentOS
journalctl -u sshd -n 50          # systemd journal

# Look for patterns indicating why connection was dropped

Common issues in logs:
- Received disconnect from X.X.X.X port YYYYY [SSH2_MSG_DISCONNECT] - Server terminated the connection
- Connection closed by authenticating user before authentication - Banner exchange issue
- Timeout before authentication - Connection timeout during handshake

Advanced notes

Network Path Issues: If SSH works from one network but not another (office vs home), the issue is likely your ISP, corporate firewall, or proxy interfering. Try:
- Using SSH over port 443 instead of 22 (if server supports it)
- Using a VPN to bypass restrictive networks
- Tunneling through HTTP proxy with tools like corkscrew

Fail2Ban Bans: Security tools may have automatically banned your IP after failed attempts. Check:

bash
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip X.X.X.X

MaxStartups Misconfiguration: If many connections are happening simultaneously, the server's MaxStartups setting may drop new ones. Adjust in /etc/ssh/sshd_config:

bash
MaxStartups 100:30:1000  # Start dropping at 100, drop all at 1000

SSH Protocol Version Mismatch: Very old SSH servers (SSHv1) may have different handshake behavior. Most modern systems use SSHv2, but force it if needed:

bash
ssh -1 user@hostname  # Force SSHv1 (discouraged, use only for legacy systems)

Frequently asked questions

What does "banner exchange: Connection to hostname port 22: Software caused conne" mean?
The SSH banner exchange is the initial handshake where the client and server identify themselves to each other. ) is actively terminating the connection before the SSH protocol can be fully established. This differs from a simple timeout or refused connection—the connection is being initiated but then abruptly closed by some software on your system or network path.
How do I fix "banner exchange: Connection to hostname port 22: Software caused conne"?
This error occurs when the SSH client cannot complete the initial banner exchange with the server due to network interruption, firewall blocking, or server misconfiguration. It typically means the connection was closed unexpectedly during the protocol identification phase.
What causes "banner exchange: Connection to hostname port 22: Software caused conne"?
Firewall (Windows Firewall, iptables, ufw, firewalld) is blocking or interrupting SSH traffic Third-party antivirus or security software terminating the connection mid-handshake Network proxy or intercepting tool interfering with SSH protocol negotiation
Is the "banner exchange: Connection to hostname port 22: Software caused conne" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading