How to Fix VS Code Remote-SSH Pipe Closed and Corrupted MAC Errors on Travel Wi-Fi

You settle into a seat at a train station or open your laptop on hotel Wi-Fi, open VS Code, and connect to your staging server via Remote-SSH.

For the first three minutes, everything looks fine. You pull up a file, run `git status`, and start editing a deployment script. Then, the moment you run a command that outputs a large wall of text—like pulling container logs or running a multi-line test suite—the editor freezes.

The cursor stops responding. The bottom status bar turns from blue to warning orange: "Attempting to reconnect..."

A few seconds later, the bottom right notification pops up: "Could not establish connection to host: The process tried to write to a nonexistent pipe." If you dig into the SSH output log inside VS Code, you find the real diagnostic clues buried at the bottom: `Bad packet length`, `Corrupted MAC on input`, or `packet_write_wait: Connection to host: Broken pipe`.

You reconnect, enter your passphrase or MFA token again, wait for the remote VS Code server daemon to initialize, and lose your command context. Five minutes later, it happens again.

Most developers assume the travel Wi-Fi is simply "slow" or that the remote server's OpenSSH daemon is overloaded. But if raw bandwidth were the problem, latency would just increase—packets wouldn't be rejected as mathematically invalid.

The root cause on hotel, airport, and mobile hotspot networks is packet fragmentation combined with Path MTU Discovery (PMTUD) failure.

Under standard Ethernet conditions, your laptop expects a Maximum Transmission Unit (MTU) of 1500 bytes. When you send SSH traffic, packets are constructed to fit neatly within this limit. However, travel networks rarely provide clean Ethernet transit. Hotel captive portals, mobile cellular modems, and transit Wi-Fi controllers wrap your traffic inside their own nested encapsulation layers (such as PPPoE, GRE, or internal VLAN tags), which reduces the actual allowable packet payload size down to 1420, 1380, or even lower.

When a packet exceeds this reduced ceiling, intermediate network equipment is supposed to send back an ICMP "Fragmentation Needed" packet telling your machine to scale down. But hospitality firewalls and telecom middleboxes aggressively drop ICMP packets as a crude security measure.

The result is a classic black hole. Small packets—like your individual keystrokes in a terminal—pass through without issue because they remain under the reduced threshold. But as soon as VS Code synchronizes a file buffer or the remote server returns a large terminal burst, the payload exceeds the hidden ceiling. The oversized packet is either dropped silently or clipped mid-flight. When the SSH client receives a fragmented or incomplete payload, the cryptographic checksum fails, triggering `Corrupted MAC on input` or `Bad packet length`, and the SSH process immediately severs the socket.

Turning on a generic commercial VPN often makes this worse instead of better. A standard VPN adds its own 40 to 80 bytes of encryption overhead onto every packet. If the VPN client doesn't actively clamp the Maximum Segment Size (MSS) or adjust local interface MTU to account for the restrictive underlying network, oversized packets hit the travel gateway even faster, accelerating the disconnection loop.

To keep a persistent VS Code Remote-SSH session stable across travel networks, your tunnel setup must satisfy two specific networking requirements:

First, it must enforce custom MTU clamping. The VPN client needs to dynamically adjust the tunnel interface down (often to 1280 or 1320 bytes) and clamp MSS on TCP handshakes. This guarantees that every packet constructed by your OS and VS Code fits safely inside the travel network's physical transport limits without fragmenting or relying on broken ICMP signals.

Second, it must provide seamless automated session persistence. When switching between a hotel's patchy 5 GHz band and a phone tether, or when surviving brief packet loss spikes, the tunnel should handle transport-level reconnections without dropping the virtual interface or resetting the local TCP socket state that VS Code's background client daemon depends on.

This is where ONLYDOGSVPN fits into a remote developer's travel setup. It includes configurable MTU controls directly within its connection profiles, allowing you to drop packet limits below restrictive hotel encapsulation thresholds with a single toggle. Paired with low-overhead WireGuard and OpenVPN protocols that cleanly handle underlying carrier handoffs, it prevents the packet truncation that breaks SSH encryption layers, keeping your remote editor connected even across congested shared links.

Before you invest in specialized network routing, however, it is worth checking a few edge cases where a VPN will not fix the issue:

1. Server-side aggressive timeout settings. If your target server's `/etc/ssh/sshd_config` lacks `ClientAliveInterval` settings or has an extremely short `ClientAliveCountMax`, the server itself will terminate idle sessions. Ensure your local `~/.ssh/config` includes `ServerAliveInterval 30` and `ServerAliveCountMax 3`.

1. Out-of-memory kills on the remote machine. If you are remoting into a tiny VPS or micro instance with less than 2 GB of RAM, the VS Code remote node process itself may be killed by the Linux OOM killer when indexing large workspaces. Checking `dmesg -T` on the server will confirm if this is happening.

1. Local firewall software or third-party endpoint protection blocking Node.js child processes from binding to local named pipes.

If your remote host has adequate resources and the disconnects consistently coincide with large command outputs, multi-file diffs, or traveling between guest access points, the culprit is almost certainly transport packet drops.

Setting up a tunnel with properly clamped MTU boundaries eliminates packet clipping at the hotel gateway. Once the packet overhead is sized correctly for the underlying link, your remote terminal stays open, your unsaved workspace state remains intact, and you can finish your maintenance window without babysitting an unstable SSH pipe.