GuidesSecurity

What is mosh? The remote shell that survives roaming, sleep, and bad Wi-Fi

Mosh replaces interactive SSH with a UDP session that follows you across networks and laptop sleeps. How it works, the scrollback and forwarding trade-offs, and the tmux pairing.

August 10, 2026Updated September 8, 2026The Everpod team
The short answer

Mosh (“mobile shell”) is a replacement for interactive SSH built for connections that move and drop. It logs you in over regular SSH, then switches to its own UDP protocol, after which you can change networks, put the laptop to sleep, or lose signal entirely, and the session survives. It also echoes your typing instantly instead of waiting a round-trip. The trade-offs: no scrollback (run tmux inside it), no port forwarding, and your server’s firewall needs UDP ports 60000–61000 open. For anyone who checks on a remote agent from a phone or train Wi-Fi, it’s the difference between a session and a séance.

What it fixes about SSH

SSH runs over TCP, which welds your session to one network path: change IP, drop signal for a minute, or sleep the machine, and the connection is gone. Mosh was built at MIT (by Keith Winstein and collaborators; the paper landed at USENIX 2012) to attack exactly that. Its promise, in the project’s own words: “Use Wi-Fi on the train, Ethernet in a hotel, and LTE on a beach: you’ll stay logged in.” Roaming works even when your device doesn’t know its public IP changed. Sleep-and-resume works the same way: wake the laptop and the session is just… there. And because Mosh authenticates every datagram, an attacker who can forge a single TCP reset can kill an SSH connection, but only causes a transient outage on a Mosh one.

The other fix is feel. SSH shows your keystroke only after the server echoes it back, miserable at 300ms. Mosh runs a predictive model locally and shows typing, deleting, and line editing instantly, underlining predictions it isn’t sure about on bad links. It works even inside full-screen programs like vim.

How it works

There’s no new server daemon listening and no new authentication system. The mosh command logs into the server over ordinary SSH with your ordinary credentials, starts a mosh-server process as your user, receives a session key and UDP port back over the SSH channel, closes the SSH connection, and talks UDP from then on, encrypted with AES-128 in OCB3 mode. Server and client each keep a snapshot of the screen and sync state (the State Synchronization Protocol) rather than replaying a byte stream, which is why a flaky link skips intermediate frames instead of buffering three minutes of scroll. No root required on either end; the processes last only as long as the session.

The limits

Installing and using it

Both ends need the package: sudo apt install mosh on Debian/Ubuntu servers, brew install mosh on a Mac. Then mosh user@host exactly where you’d have typed ssh user@host. On phones it’s a client feature rather than a package: Blink Shell ships it on iOS and Termius supports it on every plan; the phone-terminal guide covers that pairing, where mosh matters most: iOS kills background connections by design, and a mosh session reattaches like nothing happened. For an always-on agent box, the stack writes itself: the agent lives in tmux, tmux lives on the server, and mosh is how your unreliable pocket-network reaches it.

Your own cloud agent, set up for you.

Everpod runs OpenClaw on a private, always-on computer of its own: set up, secured and backed up, with model usage included. You name your agent, and say hello about fifteen minutes later.

Create your agent

First month half price, then $29/mo · model usage included · cancel anytime

Wondering what you’d do with one? See what a cloud agent can do