SSH Session Timeout Calculator
Calculate how long an idle SSH session survives from ClientAliveInterval and ClientAliveCountMax.
Inputs
0 to ignore — relevant only if ClientAliveInterval is 0
Idle Timeout (seconds)
900
Idle Timeout (minutes)
15.00
Behavior Summary
sshd sends a keepalive probe every 300s; after 3 consecutive unanswered probes (900s total) the session is disconnected.
Step by step
Values used
ClientAliveInterval (seconds) = 300; ClientAliveCountMax = 3; TCP Keep-Alive Interval (seconds, optional) = 0
Idle timeout
timeout_seconds = ClientAliveInterval × ClientAliveCountMax
Idle Timeout (seconds)
= 900
Idle Timeout (minutes)
= 15.00
Behavior Summary
= sshd sends a keepalive probe every 300s; after 3 consecutive unanswered probes (900s total) the session is disconnected.
How it works
sshd's ClientAliveInterval sets how often (in seconds) the server sends an encrypted no-op keepalive request to a client that has sent no data recently; ClientAliveCountMax is how many of those probes may go unanswered before sshd terminates the session. The effective idle timeout is therefore the product of the two — not either value alone — because the server tolerates ClientAliveCountMax missed probes before giving up, similar in spirit to TCP keepalive but implemented at the SSH protocol layer so it works through NAT and stateful firewalls that might otherwise silently drop long-idle TCP connections.
Formula
Idle timeout
timeout_seconds = ClientAliveInterval × ClientAliveCountMax
- I
- ClientAliveInterval (s)
- N
- ClientAliveCountMax
Frequently Asked Questions
Is ClientAliveInterval the same as TCPKeepAlive?
No — TCPKeepAlive operates at the TCP layer and only detects a dead network path (dropped connections, crashed client machine), while ClientAliveInterval is an SSH-protocol-level keepalive that also detects an unresponsive session and, critically, works reliably through NAT/firewalls that silently time out idle TCP connections regardless of TCP keepalive settings.
Why would I want a short ClientAliveInterval/CountMax combination?
Shorter combined timeouts (e.g. 60s × 3 = 3 minutes) reduce how long a hijacked, forgotten, or network-partitioned session remains open with an active shell — a common hardening control for jump hosts and bastion servers per CIS benchmarks.
Does this setting disconnect an SSH session with a running foreground command?
No — ClientAliveInterval only detects unresponsive clients at the protocol level; it does not interrupt or kill long-running foreground processes as long as the underlying connection is responding to keepalive probes. Idle here means no client-server traffic, not CPU idle.