Understanding Network Interface Priority
Windows 10 assigns a metric value to each network adapter to determine which connection takes precedence when multiple interfaces are active. By default, Ethernet often has a lower metric (higher priority) than Wi-Fi because it is considered more stable and faster. When you attempt an SSH connection to an embedded device with an IP like 172.16.x.x, the operating system routes traffic through the primary interface unless specified otherwise.
If you are connected to both Wi-Fi and Ethernet simultaneously, Windows might route the SSH traffic out through the wrong interface, causing a timeout even if the target device is reachable via the other network. It is crucial to understand that SSH does not automatically switch adapters; it uses the routing table established at the time of the connection attempt.
Checking Your Active Route
To verify which interface Windows is using for your SSH session, open Command Prompt as Administrator and run the following command:
route printLook for the destination network of your embedded device. If the gateway listed corresponds to your Ethernet subnet but you intend to connect via Wi-Fi, the route is incorrect. You can manually adjust this by modifying the interface metric in the Network Connections settings, ensuring the desired adapter has the lowest metric value.
IP Address Stability and DHCP
One of the most common reasons for SSH failures between Wi-Fi and Ethernet setups is the dynamic nature of DHCP-assigned IP addresses. When connected via Wi-Fi, your PC may receive a different local IP range than when connected via Ethernet. If your embedded device expects a specific source IP or if your router’s firewall restricts access based on the subnet, switching networks will break the connection.
For development environments involving embedded devices, it is highly recommended to assign a static IP address to the device itself. Additionally, consider assigning a static IP to your Windows 10 machine within the same subnet as the device. This eliminates ambiguity regarding which network segment the traffic should traverse.
Verifying Subnet Alignment
Run ipconfig in Command Prompt to check your current IPv4 address and subnet mask. Ensure that the last octets of your PC’s IP and the embedded device’s IP fall within the same subnet. For example, if your PC is on 192.168.1.50 with a subnet mask of 255.255.255.0, the device must be on 192.168.1.x. If they differ, you cannot establish a direct Layer 3 connection without a router or bridge configuration.
Firewall Configuration Differences
Windows Defender Firewall treats inbound and outbound connections differently based on the network profile assigned to the adapter. Wi-Fi connections are often classified as "Public" by default, while Ethernet connections are frequently set to "Private." A Public network profile blocks most unsolicited incoming connections, including SSH requests initiated from other devices to your PC, though outbound SSH from your PC to a device is usually permitted.
However, if you are trying to connect *from* a remote machine *to* your Windows 10 PC over Wi-Fi, the Public profile will likely block the connection. You need to ensure that the firewall rule for SSH (Port 22) is enabled for the correct network profile.
Adjusting Firewall Rules
To allow SSH traffic, go to Control Panel > Windows Defender Firewall > Advanced Settings. Create a new Inbound Rule for Port 22 TCP. Under the Scope tab, specify the IP addresses of the trusted networks. Then, under the Advanced tab, ensure the rule applies to both Private and Public profiles if you need cross-network compatibility. Restart the SSH service or reconnect after making these changes.
Troubleshooting Common Symptoms
If you experience intermittent drops or timeouts, check the physical layer first. Wi-Fi signals are susceptible to interference, which can cause packet loss that SSH interprets as a broken pipe. Ethernet provides a dedicated duplex channel, minimizing latency and jitter. Use ping -t [device_ip] to monitor packet loss over several minutes. If ping succeeds but SSH fails, the issue is likely application-layer or firewall-related rather than network-layer.
For more detailed steps on configuring your network adapters for optimal performance, see our guide on SSH Specific: Setting up WiFi or Ethernet Connection on Windows 10.
Frequently Asked Questions
Why does my SSH connection drop when I switch from Wi-Fi to Ethernet?
The connection drops because the underlying IP address changes, invalidating the existing session state. The server detects a change in the source IP and terminates the session for security reasons. You must close and reopen the SSH client to establish a new session with the new IP address.
Can I force Windows to use only Wi-Fi for SSH even if Ethernet is plugged in?
Yes, you can disable the Ethernet adapter in Device Manager or disconnect the cable temporarily. Alternatively, you can increase the metric of the Ethernet adapter in Network Adapter settings so that Windows prioritizes Wi-Fi for all traffic, including SSH.
Does Windows Firewall block SSH by default on public Wi-Fi?
Outbound SSH connections are generally allowed on public Wi-Fi, but inbound connections from other devices to your PC are blocked. If you are trying to access your PC remotely over Wi-Fi, you must explicitly enable the inbound rule for Port 22 in the firewall settings.
How do I find the correct IP address for my embedded device?
Use the arp -a command in Command Prompt after attempting a ping to the broadcast address of your subnet. This will list the MAC addresses and corresponding IPs of devices currently visible on your local network segment.
Is it safer to use SSH over Wi-Fi or Ethernet?
Ethernet is generally safer because it is harder for unauthorized users to intercept traffic compared to wireless signals. However, SSH encrypts the data regardless of the medium, so both are secure against eavesdropping if properly configured. Ethernet reduces the risk of accidental disconnection and signal degradation.