This isn't an SSH deep dive,
but we can skim the packet capture to gain a high-level
understanding of what is going on.
The client and server begin by exchanging what kind of protocol they are using,
and in this case, it's SSH V2 using the OpenSSH service.
Then the SSH speakers need to tell one another which
ciphers and hash algorithms they support.
This is not the key exchange itself, but some introductory chatter.
Next, the Diffie Hellman process starts.
The client gets the server's public key and the devices
derive their secret session keys.
Shortly thereafter, all future communication is encrypted,
including client authentication and data traffic.
SFTP is an application that is tunneled inside SSH so that all
traffic looks like SSH to intermediate network devices.
If you look at the packet captures I supplied,
you'll see that only this one TCP flow using source port
54200 and destination port 22 is present.
That keeps things simple from a security perspective, as we'll explore in the next clip.