Which keepalive mechanism should PuTTY prioritize for NAT traversal: TCP keepalives or application-level SSH keepalives

Choosing Between Keepalive Mechanisms in PuTTY

PuTTY implements two distinct keepalive mechanisms in the Connection panel. The 'Enable TCP keepalives' option sets the SO_KEEPALIVE socket option, which relies on OS-controlled timing often spanning hours. The 'Seconds between keepalives' setting sends null SSH packets at user-defined intervals measured in seconds.

TCP keepalives operate at the transport layer without consuming SSH bandwidth but may fire too infrequently to maintain NAT or stateful firewall mappings. Application-level keepalives reliably refresh network state at the cost of generating continuous background traffic. However, application-level keepalives can mask genuinely broken connections by making sessions appear alive even when the network path has failed.

The PuTTY documentation does not establish a precedence or interaction model when both options are enabled simultaneously. The unresolved decision centers on selecting the appropriate mechanism given conflicting requirements: NAT timeout constraints demand frequent state refresh while operational needs favor rapid failure detection.

There is no documented guidance on which approach to prioritize or how to configure both options for optimal behavior across different network environments.

• Which keepalive mechanism should be prioritized when both NAT timeout and broken-connection detection matter?
• How do the two keepalive options interact when both are enabled in PuTTY?
• What is the recommended configuration for environments with aggressive NAT timeouts?