Determining whether existing TCP connections use KeepAlive under Windows

On Windows (Vista and later), there is a way, or tool, that can help identify an existing, already established outbound TCP connection, was created using the SO_KEEPALIVE option.

On Unix platforms, this can usually be seen with netstat (i.e. netstat -o will display a separate column for KEEPALIVE).

Netstat on Windows does not have this feature. I also have not tested other Microsoft / SysInternals network tools.

I can't seem to find a tool that can provide this information.

Scenario: Applications running on a Windows 2008 R2 server must have the TCP keepalive protocol for all the connections it establishes. In some applications, it is not possible to enable TCP keepalive, and I need some way to determine if this is enabled by default for these applications.

To be clear: I need some kind of tool or suggestions on how to program a tool that shows that existing winsock connections support TCP keepalive or not. Although there are other ways to determine this (for example, sniffing traffic and see if keepalive packets are being sent), they all have uncertainty. In addition, we are talking about many servers and many applications.

+6
source share
1 answer

Use WireShark to view TCP Keepalive packets. If you need to check loopback as I used https://github.com/nmap/npcap

0
source

All Articles