How to fix Write failed: Broken pipe in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 232 views

The SSH connection unexpectedly closed because the TCP connection was terminated. This usually happens when an idle session times out or network connectivity is lost.

Quick fix

Fixes EPIPE

ssh -o ServerAliveInterval=60 user@host
  1. Enable ServerAliveInterval on the client
  2. Enable TCPKeepAlive on the client (optional but recommended)
  3. Configure server-side keep-alive (if you have server access)
  4. Test the configuration
ssh — error
ssh -o ServerAliveInterval=60 user@host
Write failed: Broken pipe

What this error means

The 'Write failed: Broken pipe' error occurs when the SSH client tries to send data to the server, but the underlying TCP connection has been closed. A broken pipe means the receiving end (the SSH server) has closed the connection without the client expecting it. This typically results from inactivity timeout, network interruptions, firewall rules terminating idle connections, or server-side SSH daemon configuration.

Typical symptoms

  • SSH session disconnects without warning during idle periods
  • Commands fail with 'Write failed: Broken pipe' message
  • Connection drops after a few minutes of inactivity
  • Consistent disconnection at roughly the same time interval
  • Connection works initially but fails when resuming after a break

Common causes

  1. Idle session timeout: The SSH server or an intermediary (firewall, NAT) closes connections inactive for too long, typically 5-30 minutes
  2. Network inactivity timeout: Your ISP, firewall, or NAT device terminates idle TCP connections to conserve resources
  3. Firewall rules: Aggressive stateful firewall settings drop connections without proper keep-alive packets
  4. Misconfigured SSH server: The sshd_config on the server has ClientAliveInterval set to 0 or a low value
  5. Misconfigured SSH client: The client doesn't send keep-alive packets (ServerAliveInterval not set)
  6. Network instability: Intermittent network issues, packet loss, or routing problems disrupt the connection
  7. Router or proxy timeouts: Intermediate network devices disconnect idle sessions to manage resources

How to fix "Write failed: Broken pipe"

1Enable ServerAliveInterval on the client

The ServerAliveInterval setting tells your SSH client to send keep-alive packets to the server at regular intervals, preventing idle timeout disconnections.

For a single connection:

bash
ssh -o ServerAliveInterval=60 user@host

For all future connections, edit your ~/.ssh/config file:

bash
Host *
    ServerAliveInterval 60
    ServerAliveCountMax 120

This tells SSH to send a keep-alive packet every 60 seconds, and disconnect only after 120 failed attempts (120 minutes of no response).

2Enable TCPKeepAlive on the client (optional but recommended)

TCPKeepAlive works at the TCP layer to prevent connection drops before SSH keep-alives kick in.

Add to ~/.ssh/config:

bash
Host *
    TCPKeepAlive yes
    ServerAliveInterval 60
    ServerAliveCountMax 120

TCPKeepAlive yes is usually the default, but explicitly setting it ensures TCP-level keep-alives are enabled.

3Configure server-side keep-alive (if you have server access)

If the broken pipe happens despite client-side settings, or if you administer the SSH server, configure server-side keep-alives.

Edit /etc/ssh/sshd_config on the server:

bash
ClientAliveInterval 120
ClientAliveCountMax 720

This tells the SSH daemon to:
- Send a keep-alive packet every 120 seconds
- Only drop the connection after 720 failed attempts (about 24 hours)

After editing, restart the SSH daemon:

bash
sudo systemctl restart sshd
# or on older systems:
sudo service ssh restart
4Test the configuration

Verify your settings are working by leaving an SSH session idle and checking it doesn't disconnect.

Check client configuration:

bash
ssh -G user@host | grep -i alive

Check server configuration (requires server access):

bash
sudo grep -i ClientAlive /etc/ssh/sshd_config

Connect and wait 5+ minutes without activity. If it disconnects, proceed to the next step.

5Check for firewall or ISP timeouts

If the issue persists despite proper SSH keep-alive settings, the problem may be an intermediary network device (firewall, NAT, proxy, or ISP).

Diagnose with verbose output:

bash
ssh -vvv user@host

Watch the logs for timeout messages. If the disconnect happens at a consistent interval (e.g., every 15 minutes), it's likely a firewall or ISP setting.

Solutions:
- Contact your ISP or network administrator about idle connection timeouts
- Adjust firewall rules to increase timeout thresholds
- For cloud environments (AWS, Azure, GCP), check security group rules and network ACLs
- Consider using an SSH jumphost or bastion with longer timeout settings

6Use a terminal multiplexer for persistent sessions

If keep-alive settings don't solve the problem, use tmux or screen to maintain a persistent session that survives SSH disconnects.

Using tmux:

bash
# Create a new session
tmux new-session -s work

# Detach (keeps running)
Ctrl+B D

# Reconnect later
tmux attach-session -t work

Using screen:

bash
# Create a new session
screen -S work

# Detach (keeps running)
Ctrl+A D

# Reconnect later
screen -r work

With tmux/screen, your session persists on the server even if the SSH connection breaks.

Advanced notes

Idle timeout sources: The broken pipe error can originate from multiple layers: (1) The SSH server itself (sshd_config settings), (2) A NAT device or firewall between you and the server, (3) An HTTP proxy if connecting through one, (4) Your ISP's CGNAT (Carrier-Grade NAT) timeout, typically 30-60 minutes. If you're behind a proxy, check the Apache reqtimeout_module setting, which may be terminating connections aggressively.

Root cause identification: The key to solving this is determining where the connection closes. Use ssh -vvv user@host to see detailed logs. If sshd logs (in /var/log/auth.log or /var/log/secure) show the connection was closed cleanly, it's likely client-side or firewall timeout. If logs are silent, the network device likely closed the connection.

UsePrivilegeSeparation note: On very old SSH servers (pre-OpenSSH 7.0), some users reported success by adjusting the UsePrivilegeSeparation setting in sshd_config, though this is rarely needed on modern systems.

Long-lived connections: For truly long-lived or interactive sessions, combine ServerAliveInterval with tmux/screen. This provides both keep-alive protection and session recovery if the connection does eventually drop.

Frequently asked questions

What does "EPIPE" mean?
The 'Write failed: Broken pipe' error occurs when the SSH client tries to send data to the server, but the underlying TCP connection has been closed. A broken pipe means the receiving end (the SSH server) has closed the connection without the client expecting it. This typically results from inactivity timeout, network interruptions, firewall rules terminating idle connections, or server-side SSH daemon configuration.
How do I fix "EPIPE"?
The SSH connection unexpectedly closed because the TCP connection was terminated. This usually happens when an idle session times out or network connectivity is lost.
What causes "EPIPE"?
Idle session timeout: The SSH server or an intermediary (firewall, NAT) closes connections inactive for too long, typically 5-30 minutes Network inactivity timeout: Your ISP, firewall, or NAT device terminates idle TCP connections to conserve resources Firewall rules: Aggressive stateful firewall settings drop connections without proper keep-alive packets
Is the "EPIPE" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading