Radiator Server Documentation — v10.34.2

keepalive

The keepalive block configures operating system TCP keepalive probes. TCP keepalive detects connections whose peer disappeared without closing them, such as a crashed host or a flow that a firewall or NAT device dropped. It also keeps idle connections open through devices that remove idle flows. The same block is used by listeners and by outbound backend connections, such as RADIUS backend connections and the Netlogon backend.

keepalive {
    idle 60s;
    interval 10s;
    count 3;
}
ParameterDescriptionAccepted values
idleTime without any traffic before the first probe is sentWhole seconds from 1s to 32767s
intervalTime to wait for an answer before sending the next probeWhole seconds from 1s to 32767s
countNumber of unanswered probes in a row before the connection is closed1 to 127

These are the ranges that Linux accepts. A value outside them, or a duration with a fraction of a second, is a configuration error.

Set all three parameters in every keepalive block. Without the block, TCP keepalive is disabled, unless the configuration item documents its own defaults, such as the Netlogon backend.

How the probes work

Probes are sent only on a connection that has been idle for idle. Any received or sent data, including the answer to a probe, restarts the idle time, so a busy connection is never probed.

  1. While traffic flows, no probes are sent.
  2. After idle without traffic, one probe is sent.
  3. If the peer answers, the connection is idle again, and the next probe follows after another idle period. A healthy idle connection is therefore probed once every idle.
  4. If the peer does not answer, another probe follows after interval. Probes continue every interval while they stay unanswered.
  5. After count unanswered probes in a row, the operating system closes the connection.

A peer that disappears is detected at most idle + count * interval after the last traffic. With the example above, that is 60s + 3 * 10s = 90s.