How TCP Works - What is a TCP Keepalive?

In this video, we will use Wireshark to examine TCP Keep Alive behavior. These can look scary when we see them on the screen, but what do they mean? What causes them? and When should we be concerned?
Like/Share/Subscribe for more Wireshark content!
== Links n' Things ==
▶Getting Started with Wireshark - bit.ly/udemywireshark
▶Getting Started with Nmap - bit.ly/udemynmap
== Or Catch Me Live ==
▶TCP/IP Deep Dive Analysis with Wireshark - bit.ly/virtualwireshark
== LIVE WIRESHARK TRAINING ==
Let's get in touch - packetpioneer.com/product/pri...
== Trace File Analysis Services ==
Got packet problems that you need help digging into?
www.packetpioneer.com/contact
Questions? Comments?
You know what to do below!

[@jeevanjoshi81]

A ten on ten man. very informative and very well explained. Kudos!!!!

[@katieboldizar9468]

Very good explanation of the TCP Keep Alive! Thank you for posting!

[@nandhakumarnnk2293]

Very good video for packet analysis. Thanks so much, appreciate it.

[@darrenmorrissey7502]

Extremely helpful, Thank you

[@jimboelterdotcomm9153]

Nailed it. I understand this issue much more clearly. I think I can apply this immediately to an issue at work.

[@ChrisGreer]

Awesome Jim! Thanks for the comment!

[@edmcguigan3501]

Cheers Chris. Having issues with TCP sessions aging out in the firewall and wanted a refresher on how TCP sessions are established, maintained, ended.

[@ChrisGreer]

Great! I hope this helped.

[@MahananGogoi]

Can't thank you enough Chris..You are making me better with your tutorials

[@ChrisGreer]

Really happy to hear that the videos are helping you. That is great!

[@Arun-mh7br]

Excellent! I could refresh back my memory.

[@toddstephens7678]

Thanks, for your hard work.

[@ranjanadissanayaka5390]

more info learned...thanks Chris .

[@jinyang4796]

Thank you so much for the clear record-by-record explanation!

[@ChrisGreer]

You’re welcome!

[@alkhan1080]

Hi Chris, Great video ,very informative Thank you

[@alubau]

this is great thank you ! please post more videos !

[@peteski2011]

excellent work

[@RajivKumar-ee7xv]

Wish I could explain things so clearly. Or even just half of you. You are beyond excellent as always.

[@illyam689]

don't worry too much! This guy is a beast!!!!

[@daniele.contreras3590]

Thank you, great video.

[@psteiner22]

Thank you! Very helpful.

[@ArunKumar-xw6iw]

Thanks a lot for this video. It really helps me for fixing my on going critical production issue.

[@ChrisGreer]

Glad it helped!

[@mehmetyiter899]

wonderful explanation 👌👍👋

[@cciefeb9809]

Great Videos as usual

[@yuliyacher67]

Thank you!

[@mohammadshahin8346]

Thanks a lot, it was useful, appreciated.

[@dgamma1]

thank mate!

[@punkplino]

Man, I always come back to your videos (even this one from 8 years ago), cuz you always got the right answer wich I've been looking for.... 7:13. Thank you 4eva

[@threeone6012]

Brilliant!

[@HuzaifaGujjar]

Well Explained.

[@ChrisGreer]

Thanks Huzaifa!

[@frozen_tortus]

This is awesome. Thanks Chris!

[@ChrisGreer]

My pleasure!

[@innuite]

Time and again, awesome video chris. 769 likes for this is too less.

[@akilla214u2c]

If you think the 45secs is too, long it can be changed on the L3 device with a shorter timer.

[@VyshfulThinking]

Really good video, Keep this up, amazing

[@ChrisGreer]

Thanks, will do!

[@sreenislg]

Thank you Chris for this video tutorial. I was looking at TCP conversation in my laptop. When Client send second Keep alive to Server, I see that sequence number is not changing. First and Second keep alive sequence number is similar. Any reason for having similar sequence for both first and second keep alive packets from client to Server.

[@watawonderfulworld]

Hey Chris, still don't know what's inside the TCP Keep-alive message. 'Internet Core Protocols' by Eric Hall says- most systems (TCP implementations) use "unsolicited command segment" for this.

[@RotterStudios]

great video subbed. in gtmetrix, it is suggested i increase the keep alive time for my website. any idea where to do that?

[@ChrisGreer]

Hello @rotter Without more details on the server itself, no. You would have to look into whatever the operating system is and get into the TCP stack configuration. Curious, do you know what the keep alive time presently is? If you increase it too much, you could run into a situation where you run out of server resource for new connections because it is keeping old ones open for too long. Just a heads up.

[@nirojpariyar9625]

Dear Sir, thank you so much for uploading such a informative video. And I also want to ask- to know networking details through wireshark, do we already have to know basics or does wireshark course has such content to teach us both networking and wireshark features ?

[@ChrisGreer]

Hello Niroj, Yes my Wireshark courses teach both networking protocol fundamentals and how to troubleshoot them, as well as the Wireshark analyzer itself. You can find an example of one of them here - bit.ly/wiresharktcp

[@akshay231990]

cool

[@freebk161]

Chris, What happens if Server does NOT respond back with Keep Alive ACKs? Will the Client eventually give up and reset the session?? BTW, I have been learning lot from you. You simplify the complex problems with awesome explanations !!!

[@ChrisGreer]

Yes - the client will eventually time out the TCP connection and will most likely send a reset. It will assume that the server is no longer there, or the route between them is dead. Thanks for the comment!

[@anshjain257]

will client always send tcp keep alive packets if it didn't hear from the server for some time? Or does it depends on configurations of tcp connection?

[@cybermajestic]

Hi Chris, what is difference between tcp dup ack and tcp keep-alive in packet fields?

[@ChrisGreer]

Huge difference there. Keep alives are just that - they keep the TCP session open. Duplicate acks typically are indicating packet loss.

[@dineshskhedkar4242]

Thanks Chris for your wonderful explanation. It would be helpful if you can also cover the three parameters related to tcp alive on AIX operating system and also the commands to fetch tcp dump for analysis.

[@ChrisGreer]

Great suggestion! Thanks Dinesh

[@vuihanlim671]

I love TCP keep alive rather then FW increase idle timeout to 24 hours >.

[@DikiciBurak]

Could you share the trace file with us Chris ?

[@leozou2537]

Sir, I have a question about keep alive, I send 10 request by the http request lib with keep-alive header under http1.1, eg: nodejs axios, if the requests are sent sequentially, I observered that server side will reuse one tcp connection, but if the requests are sent concureently, 10 tcp connections will be established? so how the server decide if to reuse the tcp connection or not? thank you

[@sadikd4758]

Can you provide the code for the application

[@matimematime2867]

C.G. 👍🏼💯

[@ChrisGreer]

Thanks for commenting!

[@kebman]

Looks like an inadvertent Marco Polo application. How about that!

[@ChrisGreer]

True!

[@abdulmoizsheikh8031]

How is http keep alive different from tcp keep alive?

[@ChrisGreer]

The TCP Keep alive is at the transport layer and is not application dependent. An HTTP keep alive happens where a single TCP connection is used for pipelining several HTTP requests, one after the other. This only happens with HTTP1.1 or newer.

[@abdulmoizsheikh8031]

@@ChrisGreer Interesting. So since http keep alive maintains a single connection, does it internally trigger a tcp keep alive request? Because http connections are usually encrypted and middle routers cannot see the application level data. How does that work? TIA!

[@test-cp8uz]

no i saw it in a minecraft anti cheat xd