5 / 18 TCP

Two Hours Of Waiting

A gateway holds idle TCP connections to 50000 devices. Some devices vanish without a FIN: a NAT box reboots, a laptop lid closes. Those sockets stay open on the server forever and leak memory. An engineer enables SO_KEEPALIVE and leaves the defaults alone.

What actually changes?

A

The connections stop being dropped by NAT and firewall idle timeouts, which is the real cause of the leak.

B

Dead sockets are detected within one retransmission timeout, because keepalive probes are retransmitted on the normal RTO schedule.

C

Almost nothing for hours: RFC 1122 requires the idle interval to default to no less than two hours. And a peer whose kernel is alive while its process is wedged answers every probe, so keepalive never reports it dead.

D

Nothing at all: keepalive probes carry no data, so a middlebox that has already dropped its state will discard them without a reply, and TCP treats silence as healthy.