Hello world,

I have encountered today at work a situation where I had to know which established connections are using TCP keepalive and which are not.
If you do not know what TCP keepalive is, check out this link. It explains EVERYTHING! :)

Back to my problem, sometimes looking for keepalive is difficult, involving pages of tcpdump output and so on. You do not want that. You want something simple and quick!
Interestingly, netstat can provide this with the option -o (or --timers). Yes, netstat!

Most probably you use netstat to list established connections like this:

19:44:51 root@minivm:~# netstat -n | grep ESTA
tcp        0      0 10.9.10.11:2049         10.9.10.12:732          ESTABLISHED
tcp        0      0 192.168.10.44:2049      192.168.10.30:734       ESTABLISHED
tcp        0      0 10.9.10.11:2049         10.9.10.9:633           ESTABLISHED
tcp        0      0 192.168.10.44:2049      192.168.10.33:839       ESTABLISHED
tcp        0      0 192.168.10.44:2049      192.168.10.31:898       ESTABLISHED
tcp        0      0 192.168.10.44:22        192.168.10.10:63615     ESTABLISHED

Well, using it with with -o you get an extra column which is called Timer:

19:47:22 root@minivm:~# netstat -no | egrep "Timer|ESTA"
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0 10.9.10.11:2049         10.9.10.12:732          ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.10.44:2049      192.168.10.30:734       ESTABLISHED off (0.00/0/0)
tcp        0      0 10.9.10.11:2049         10.9.10.9:633           ESTABLISHED off (0.00/0/0)
tcp        0    140 192.168.10.44:2049      192.168.10.33:839       ESTABLISHED on (0.19/0/0)
tcp        0      0 192.168.10.44:2049      192.168.10.31:898       ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.10.44:22        192.168.10.10:63615     ESTABLISHED keepalive (4483.53/0/0)

Nice :)
Now you know!

As bonus, the timer column has two fields:

keepalive (4483.53/0/0)
<field 1> <field 2>
The ffield one can have following values:
keepalive - when the keepalive timer is ON
on - when the retransmission timer is ON
off - none of the above is ON

The field two has three subfields:
(4483.53/0/0) -> (a/b/c)
a = keepalive/retransmission timer
b = number of retransmissions that have occurred
c = number of keepalive probes that have been sent

PS: now I have to find out how to get this on AIX or Solaris where netstat -o is not working.