Stop guessing ciphers. Isolate SSH traffic with ssh, then add ssh.encryption_algorithms as a column to see the exact negotiated cipher. Wireshark parses SSH_MSG_KEXINIT to reveal your key exchange. Audit with confidence.
https://www.valtersit.com/vault/wireshark-display-filter-for-ssh-protocol-and-cipher-detecti-fe8312/