Submit an edit

By default, Wireshark likes to mark TCP keep-alive packets as scary errors; opting to display them in a gruesome black-and-red and scaring anyone trying to analyze TCP dumps in an effort to debug network problems.

The reasons for this <a href="https://web.archive.org/web/20181012143747/http://www.lovemytool.com:80/blog/2014/11/are-tcp-keep-alive-messages-bad-by-chris-greer.html">are complex</a>, but in short, most TCP keep-alive packets flagged as errors in Wireshark can be safely ignored. But having them pop up in the Wireshark trace means it's a lot harder to spot <em>real</em> errors - kind of like the boy who cried wolf. Fortunately, we can filter them out quite easily.

Here's a Wireshark analysis of some captured traffic that includes a lot of "false errors" involving TCP keep-alive packets during a regular HTTP(S) session:

And after applying this simple filter:
<pre>```
!(tcp.flags.ack &amp;&amp; tcp.len &lt;= 1)
```
</pre>
We end up with a <em>much</em> better display that actually flags/highlights true causes for concern without overwhelming us with fake warnings about TCP keep-alive packets: