SSH Session Timeout Calculator
Calculate SSH idle session timeout from ClientAliveInterval and ClientAliveCountMax settings.
About SSH Session Timeout Calculator
sshd's ClientAliveInterval sets how often (in seconds) the server sends an encrypted no-op keepalive request to a client that has sent no data recently; ClientAliveCountMax is how many of those probes may go unanswered before sshd terminates the session. The effective idle timeout is therefore the product of the two — not either value alone — because the server tolerates ClientAliveCountMax missed probes before giving up, similar in spirit to TCP keepalive but implemented at the SSH protocol layer so it works through NAT and stateful firewalls that might otherwise silently drop long-idle TCP connections.
Formula
Idle timeout
timeout_seconds = ClientAliveInterval × ClientAliveCountMax
- I
- ClientAliveInterval (s)
- N
- ClientAliveCountMax
Worked example
With the default values below, SSH Session Timeout Calculator returns Idle Timeout (seconds) of 900. Change any input above and every figure here is recalculated in your browser.
Inputs used
- ClientAliveInterval (seconds)minimum 0
- 300
- ClientAliveCountMaxminimum 0
- 3
- TCP Keep-Alive Interval (seconds, optional)minimum 0
- 0
Results
- Idle Timeout (seconds)
- 900
- Idle Timeout (minutes)
- 15.00
- Behavior Summary
- sshd sends a keepalive probe every 300s; after 3 consecutive unanswered probes (900s total) the session is disconnected.
Step by step
- 1Values used
- 2Idle timeout
- 3Idle Timeout (seconds)= 900
- 4Idle Timeout (minutes)= 15.00
- 5Behavior Summary= sshd sends a keepalive probe every 300s; after 3 consecutive unanswered probes (900s total) the session is disconnected.
Assumptions and limits
- The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Is ClientAliveInterval the same as TCPKeepAlive?
No — TCPKeepAlive operates at the TCP layer and only detects a dead network path (dropped connections, crashed client machine), while ClientAliveInterval is an SSH-protocol-level keepalive that also detects an unresponsive session and, critically, works reliably through NAT/firewalls that silently time out idle TCP connections regardless of TCP keepalive settings.
Why would I want a short ClientAliveInterval/CountMax combination?
Shorter combined timeouts (e.g. 60s × 3 = 3 minutes) reduce how long a hijacked, forgotten, or network-partitioned session remains open with an active shell — a common hardening control for jump hosts and bastion servers per CIS benchmarks.
Does this setting disconnect an SSH session with a running foreground command?
No — ClientAliveInterval only detects unresponsive clients at the protocol level; it does not interrupt or kill long-running foreground processes as long as the underlying connection is responding to keepalive probes. Idle here means no client-server traffic, not CPU idle.