Why TCP KeepAlive Matters: Solving LVS and Nginx Timeout Issues

During a recent work scenario the author encountered a problem where a client accessed a service through an LVS virtual IP, which forwarded traffic to an Nginx server. When the Nginx backend took longer than 90 seconds to respond, LVS reset the TCP connection because its default session timeout is 90 seconds.

The same behavior can appear on commercial load balancers such as F5, which also terminate idle sessions after a timeout, though they may send a RESET only when the client later transmits data.

To address this, the author explores TCP KeepAlive, a mechanism that periodically sends empty packets to verify that the peer is still reachable. The article first clarifies that TCP itself has no concept of “request”; that belongs to higher‑level protocols like HTTP.

Why KeepAlive Is Needed

When a TCP connection remains idle for a long period, KeepAlive probes allow both ends to detect a dead peer and close the socket gracefully, preventing load‑balancer resources from being exhausted.

How to Enable KeepAlive on Linux

Linux does not have a global switch for TCP KeepAlive; it must be enabled per socket. Three kernel parameters influence the behavior:

net.ipv4.tcp_keepalive_intvl = 75
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_time = 7200

These values control the interval between probes, the number of probes, and the idle time before the first probe (in seconds).

Applications can also set socket‑level options via setsockopt:

TCP_KEEPCNT  // overrides tcp_keepalive_probes
TCP_KEEPIDLE // overrides tcp_keepalive_time
TCP_KEEPINTVL // overrides tcp_keepalive_intvl

For example, if the kernel default keepalive time is 7200 s but an application sets TCP_KEEPIDLE to 60, the first probe will be sent after 60 seconds of inactivity.

TCP KeepAlive vs. HTTP Keep‑Alive

TCP KeepAlive and HTTP Keep‑Alive are unrelated. TCP KeepAlive works at the transport layer to verify link liveness, while HTTP Keep‑Alive (or Connection: keep-alive) allows multiple HTTP requests to reuse the same TCP connection, reducing the overhead of establishing new connections.

Configuring TCP KeepAlive in Nginx

The author initially tried to set keepalive_timeout in Nginx, which only affects HTTP keep‑alive, not TCP keepalive. By inspecting Nginx source code, the correct way to enable TCP KeepAlive is to use the so_keepalive parameter on the listen directive, e.g.: listen 80 so_keepalive=60s; Setting this option resolved the LVS timeout problem, allowing long‑running requests to complete without the connection being reset.

References

• "TCP/IP Illustrated, Volume 1" – for fundamental networking concepts.

• TCP Keepalive HOWTO

• Nginx Core Module Documentation

• Nginx source code: https://github.com/alibaba/tengine