Which PuTTY keep-alive interval prevents NAT timeouts without triggering server-side security alerts?

Question

PuTTY provides a mechanism under Connection > SSH to send null packets at specific intervals to maintain active sessions. This is primarily used to prevent firewalls or NAT gateways from dropping idle TCP connections.
While this client-driven behavior ensures session persistence, there is a tension between maintaining the connection and avoiding security triggers. Setting the interval too low may cause security appliances to flag the traffic as a denial-of-service attempt, while setting it too high may fail to prevent the timeout.
Does the interaction between PuTTY's keep-alive packets and the server's ClientAliveInterval create redundant traffic that impacts performance? What is the recommended interval to balance stability against security appliance sensitivity?

Siddharth · Answer

Answer
For most consumer‑grade NAT devices the idle‑timeout is 30–45 seconds. Setting PuTTY’s Connection > Seconds between keepalives to 60 seconds keeps the TCP session alive while staying well below the thresholds that most server‑side intrusion‑detection systems flag.
Why the interval matters

PuTTY’s keep‑alives are simple TCP NULL packets sent from client to server.
The server’s ClientAliveInterval is a separate SSH‑level keep‑alive sent from server to client.
Because they travel in opposite directions they do not duplicate traffic; each side merely prevents the other’s socket from timing out.

Recommended setting for this case

Open PuTTY, go to Connection > SSH.
Set Seconds between keepalives (0 to disable) to 60.
Save the session and reconnect.
Leave the session idle for a few minutes and confirm the connection remains open.

What to verify

Check the NAT’s connection‑tracking timeout in its management UI. It should be ≥60 seconds; if it is 30 seconds, consider 30 for the keep‑alive.
On the server, look at sshd logs for any idle timeout or keep‑alive entries that coincide with the interval you set.
If your server’s policy flags keep‑alives under 30 seconds, avoid setting the interval lower than that value.

Missing diagnostic detail
What is the exact idle‑timeout value configured on your NAT gateway? Knowing that number lets us fine‑tune the keep‑alive precisely.

Which PuTTY keep-alive interval prevents NAT timeouts without triggering server-side security alerts?

1 answer

Answer

Why the interval matters

Recommended setting for this case

What to verify

Missing diagnostic detail

Your perspective belongs here.

0 question comments