Question
Which PuTTY keep-alive interval prevents NAT timeouts without triggering server-side security alerts?
Neel Orbit
0 reputation · 03 Jun 2020, 02:25 UTC
115K views
Loading…
0 reputation · 03 Jun 2020, 02:25 UTC
PuTTY provides a mechanism under Connection > SSH to send null packets at specific intervals to maintain active sessions. This is primarily used to prevent firewalls or NAT gateways from dropping idle TCP connections.
While this client-driven behavior ensures session persistence, there is a tension between maintaining the connection and avoiding security triggers. Setting the interval too low may cause security appliances to flag the traffic as a denial-of-service attempt, while setting it too high may fail to prevent the timeout.
Does the interaction between PuTTY's keep-alive packets and the server's ClientAliveInterval create redundant traffic that impacts performance? What is the recommended interval to balance stability against security appliance sensitivity?
For most consumer‑grade NAT devices the idle‑timeout is 30–45 seconds. Setting PuTTY’s Connection > Seconds between keepalives to 60 seconds keeps the TCP session alive while staying well below the thresholds that most server‑side intrusion‑detection systems flag.
putty
sshClientAliveInterval is a separate SSH‑level keep‑alive sent from server to client.60.30 for the keep‑alive.sshd logs for any idle timeout or keep‑alive entries that coincide with the interval you set.What is the exact idle‑timeout value configured on your NAT gateway? Knowing that number lets us fine‑tune the keep‑alive precisely.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 03 Jun 2020, 10:54 UTC
PuTTY’s Connection > SSH > Seconds between keepalives sends SSH‑level NULL packets. They are tiny and don’t duplicate traffic sent by the server’s ClientAliveInterval. The real question is: how long does your path stay idle before the NAT or firewall drops the TCP state?
sshd logs to note when the TCP entry disappears or when the client can no longer send data.Once you know IdleCutoff, configure PuTTY to send keep‑alives at roughly one‑third or half of that time. For example, if the cutoff is 90 s, a 30–45 s interval is safe. If it’s 180 s, 60–90 s works well.
ClientAliveInterval, you can leave PuTTY’s keep‑alive at 0 (disabled) and rely on the server.0 to avoid redundant traffic.Very frequent keep‑alives (e.g., < 10 s) can trigger anomaly detectors that flag “high‑rate keep‑alive traffic.” Keep the interval comfortably above that threshold unless you’ve verified otherwise.
After changing the setting, reconnect and leave the session idle for a few minutes. Verify that the connection stays open and that your IDS logs show no new alerts.
| Path type | Typical idle cutoff | Recommended PuTTY keep‑alive |
|---|---|---|
| Home / consumer‑grade NAT | 30–60 s | 10–30 s |
| Office / managed firewall | 120–300 s | 60–150 s |
| VPN tunnel | 180–600 s | 90–300 s |