What is TCP Keepalive and How Does It Work?
Learn how TCP keepalive probes idle connections, its idle time, interval, and probe count settings, and how it detects dead peers.
Expected Interview Answer
TCP keepalive is an optional mechanism where an idle connection periodically sends a small probe segment to check whether the peer is still reachable and the connection is still valid, closing it if enough probes go unanswered.
Without keepalive, a TCP connection with no data flowing can sit open indefinitely even if the peer has crashed, rebooted, or become unreachable, because TCP itself has no built-in idle-connection detection at the application level. When keepalive is enabled on a socket, after a configured idle period (commonly defaulting to two hours on Linux) the OS sends a keepalive probe; if the peer responds, the timer resets, but if a configured number of probes (typically nine) go unanswered at a configured interval (commonly 75 seconds), the connection is declared dead and torn down. This is distinct from application-level heartbeats, which are more configurable and portable but require extra code; TCP keepalive works transparently at the socket layer with just a few options, which matters for detecting silently dropped connections behind NAT devices or after a peer crash where no FIN or RST was ever sent.
- Detects dead peers that never sent a graceful close
- Prevents connections from lingering forever behind NAT or firewalls
- Works transparently at the socket layer with minimal app code
- Configurable idle time, probe interval, and probe count per socket
AI Mentor Explanation
TCP keepalive is like a coach who, during a long lull in play with no boundaries or wickets, periodically radios the umpire just to check “are you still there?” If the umpire always responds, the coach assumes everything is fine and waits for the next lull to check again. But if several check-ins in a row go unanswered, the coach assumes the umpire has left the ground and ends the session — exactly the probe-and-timeout pattern TCP keepalive uses on an idle connection.
Step-by-Step Explanation
Step 1
Enable keepalive
The application sets SO_KEEPALIVE on the socket to opt into the mechanism.
Step 2
Idle timer expires
After the configured idle time with no data exchanged, the OS sends a keepalive probe segment.
Step 3
Probe response check
If the peer ACKs the probe, the timer resets; if not, the OS retries at the probe interval.
Step 4
Declare connection dead
After the configured number of unanswered probes, the connection is closed and reported to the application.
What Interviewer Expects
- Explains keepalive detects dead peers on otherwise idle connections
- Names the three tunables: idle time, probe interval, probe count
- Distinguishes TCP-layer keepalive from application-level heartbeats
- Mentions its usefulness behind NAT/firewalls where silent drops happen
Common Mistakes
- Confusing TCP keepalive with HTTP keep-alive (persistent connections)
- Assuming keepalive is enabled by default on all sockets
- Not knowing the default idle timeout is often very long (e.g. 2 hours on Linux)
- Thinking keepalive replaces the need for application-level health checks
Best Answer (HR Friendly)
“TCP keepalive is like a periodic "are you still there?" check on a connection that has gone quiet. If nobody answers after a few tries, the operating system assumes the other side is gone and closes the connection, which is really useful for catching crashed servers or dropped links behind firewalls that never sent a proper goodbye.”
Code Example
import socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# Turn on TCP keepalive for this socket
sock.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)
# Linux-specific tuning: idle time, probe interval, probe count
sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPIDLE, 60) # seconds idle before first probe
sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPINTVL, 10) # seconds between probes
sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_KEEPCNT, 5) # failed probes before giving up
sock.connect(("example.com", 443))Follow-up Questions
- How does TCP keepalive differ from an application-level heartbeat protocol?
- Why might keepalive probes fail to detect a dead connection quickly enough for some apps?
- How do NAT devices and firewalls interact with idle TCP connections?
- What are typical default keepalive settings on Linux versus other OSes?
MCQ Practice
1. What socket option enables TCP keepalive?
SO_KEEPALIVE turns on the keepalive mechanism for a socket.
2. What happens if all configured keepalive probes go unanswered?
After the configured number of failed probes, the OS closes the connection and reports it to the application.
3. Why is TCP keepalive particularly useful behind NAT devices?
NAT/firewall state can expire silently, and keepalive detects that the connection is no longer reachable.
Flash Cards
What is TCP keepalive? — A probe mechanism that checks if an idle connection's peer is still reachable.
How is it enabled? — By setting the SO_KEEPALIVE socket option.
Three tunables? — Idle time before first probe, probe interval, and probe count before giving up.
TCP keepalive vs app heartbeat? — Keepalive works transparently at the socket layer; heartbeats are application-level and more configurable.