🫀 SO_KEEPALIVE — How your server detects dead connections before the client knowsA client connects to your server.

[marcelschmall@infosec.exchange]

🫀 SO_KEEPALIVE — How your server detects dead connections before the client knows
A client connects to your server. Then their laptop lid closes. WiFi drops. Router reboots.
The TCP connection is dead — but your server has no idea. It just sits there. Holding a socket. Waiting forever.

This is called a half-open connection — one of TCP’s most silent failure modes.

The fix — one line:
setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &flag, sizeof(flag));

The kernel now sends small probe packets on idle connections. No response after a few tries? Connection gets cleaned up automatically.

️ Three knobs you control:
→ tcp_keepalive_time — idle time before first probe (default: 2h )
→ tcp_keepalive_intvl — time between probes (default: 75s)
→ tcp_keepalive_probes — failures before giving up (default: 9)
The defaults are hilariously conservative. For a real server you want minutes, not hours.

Without it you risk:
→ File descriptor leaks
→ Thread pool exhaustion
→ Memory piling up for connections that died hours ago

Who needs it most:
→ WebSockets & long-lived connections
→ Servers behind NAT — routers silently drop idle mappings
→ Any server where clients disappear without sending FIN

Your server shouldn’t mourn connections that are already gone.

#Linux #Networking #SystemsProgramming #ServerDevelopment