TCP Keep-alive timer changed from 2 minutes in SGOS 4.x to 2 hours in SGOS 5.x

<< Back to Knowledge Search

Technical Alert

Affected Products

ProxySG and later


ProxySG OS versions and later has an RFC compliant TCP Keep-alive timer of 2 hours.  According to RFC1122, section

Keep-alive packets MUST only be sent when no data or acknowledgement packets have been received for the connection within an interval.  This interval MUST be configurable and MUST default to no less than two hours.

However, this was not the implementation in SGOS 4.x.  In version 4.x, the keep-alive timer was set to 2 minutes (120 seconds).  Because of this implementation and the long history of SGOS 4, some Blue Coat customers may have implementations which rely on the shorter keep-alive timer. 

Though many applications do not rely on the TCP keep-alive timer and have their own application-based keep-alive messages, some applications such as FTP do use the TCP timer. 

For example, an FTP connection will have a control connection over which commands are sent and a separate data connection over which files are sent.  A slow connection will have a lot of activity on the data connection, but none on the control connection after it is established.  If the control connection times out, the file transfer may fail.


While the issue, strictly speaking is not a violation of established standards, it is a change in functionality.  Therefore, Blue Coat has released a new version of SGOS 5.x ( which provides a Command Line Interface command switch to allow an administrator to globally change the TCP Keep-alive timer.  The range will be anywhere from 60 seconds (1 minute) and 7200 seconds (2 hours).


This issue was resolved in SGOS  The TCP-IP keepalive timeout can now be set, a range of 1 minute to 2 hours can be selected (60 and 7200 seconds).  This can be done using the following command in the ProxySG Command Line Interface in Config Terminal mode:
#(config)tcp-ip tcp-keepalive-timeout 7200

Administrators can view the current keepalive timeout with the following command:
#(config)show tcp-keepalive-timeout

You can download SGOS here:


There is no workaround presently available in SGOS 5.  A fix is available in SGOS

Bug Number


InQuira Doc IdTFA36

Article Feedback

Hide Properties
First Published      10/01/2014
Last Modified      10/01/2014
Last Published      10/01/2014
Article Audience
Product      ProxySG
Software      SGOS 5
Topic      Networking
Article Number      000007650
Was this helpful?
Previous MonthNext Month