Skip to main content
protocols.pageprotocols.page
networking

Keep-Alive

Keep-alive has two meanings: TCP keep-alive sends periodic probes on idle connections to detect dead peers (default: 2 hours). HTTP keep-alive (Connection: keep-alive) reuses a TCP connection for multiple requests, avoiding repeated handshake overhead. Both reduce connection churn but serve different purposes.

Definition

TCP keep-alive is an OS-level mechanism that sends empty ACK probes on idle connections. If the peer does not respond after multiple probes, the connection is considered dead and closed. Linux defaults: tcp_keepalive_time=7200s (2 hours before first probe), tcp_keepalive_intvl=75s (between probes), tcp_keepalive_probes=9 (failures before close). These defaults are too conservative for most applications – cloud load balancers and NAT gateways typically timeout idle connections after 5-15 minutes, long before TCP keep-alive fires. Applications should set SO_KEEPALIVE with shorter intervals or implement application-layer heartbeats. HTTP keep-alive (persistent connections) is entirely separate – it signals that the TCP connection should remain open for subsequent HTTP requests rather than closing after each response. HTTP/1.1 defaults to keep-alive; HTTP/2 always uses persistent connections.

Examples

  • –setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &enable, sizeof(int))
  • –sysctl net.ipv4.tcp_keepalive_time=600 – probe after 10 min idle
  • –HTTP/1.1 Connection: keep-alive – reuse TCP connection for next request

Related Protocols

tcphttp

Related Terms

Three-Way Handshake

The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a connection between client and server. It synchronizes sequence numbers, negotiates options (MSS, window scale, SACK, timestamps), and costs exactly 1 RTT before data can flow. TLS adds 1-2 more RTTs on top.

Four-Way Teardown

TCP four-way teardown (FIN, ACK, FIN, ACK) gracefully closes a connection. Each side independently signals it has no more data (FIN) and acknowledges the other's FIN. The initiator enters TIME_WAIT for 2*MSL (60-120s) after close, consuming a socket until the timer expires.