Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I ran Wireshark on my PC and found that my chrome browser was sending LOTS of Keep-alive packets even when there are no sites loaded in the browser, and even when there are no extensions installed!! I don't recognize the IPs that Chrome is trying to contact. Does anyone know what this is all about?

I have three PCs and two out of three exhibit this behavior of sending keep-alive packets. One does not. It's possible that this is due to wireshark settings??

I can post details of the OS, Chrome version and wireshark export for each if necessary but it would get pretty long. So, please let me know if there is any other info I should post that would help determine the cause of this.

Edit

This is embarassing. I can't seem to replicate the problem on either PCs right now! I saved my earlier wireshark logs as .txt files so I'm running wireshark again to capture some .pcap files and I'm not seeing the problem! I get pairs of random keep-alive packets as opposed to 35+ in a row as previously. See http://cloudshark.org/captures/12d73929a99f for what I can log at time of this edited posting.

Earlier text output can be seen at http://pastebin.com/69JSMF7K

Would there be any specific reason that these keep-alive packets happen more often during certain times of the day?

share|improve this question
    
I'd be interested in seeing the packet trace. Can you maybe post it to CloudShark and just post the link here? –  Spiff Jun 26 '11 at 1:06
    
@Spiff: Edited my post above with some additional info. –  nmc Jun 26 '11 at 2:30
    
@nmc Thanks for the traces. They were interesting to analyze, but I'm stumped. It did seem like most of the addresses they were sending keepalives to were owned by Google. (Tip: When reverse DNS lookups fail, use whois.) –  Spiff Jun 26 '11 at 4:39
    
What process was the source, Chrome.exe? Could it have been the update function? Try opening the About dialog and see if it does it again (especially if you can do so with a version that is behind the current one). –  Synetech Jun 26 '11 at 19:17
1  
@nmc: I don't see any don't in It did seem like most of the addresses they were sending keepalives to were owned by Google... –  Tom Wijsman Jul 2 '11 at 20:51
show 3 more comments

3 Answers

up vote 2 down vote accepted

You may want to check out this article regarding keep-alive timeouts:

Interestingly one of the other things I noticed while doing this test with Wireshark is that after 45 seconds, Chrome would send a TCP keep-alive packet, and would keep doing that every 45 seconds until the 5 minute timeout. No other browser would do this.

My guess would be that Chrome had opened a connection to the Google Instant server (probably as soon as you typed something in the browser bar) and then is sending the keep-alives to keep the connection open until the browser is finally closed. As mentioned in the article above, many NAT routers will close an idle connection after 2 minutes so various browsers will send keep-alives on intervals shorter than that to keep connections open.

share|improve this answer
add comment

@Sathya: I don't think so. My version is up to date and as Spiff said, the IPs don't appear to belong to Google. – nmc 2 days ago

Erm... http://74.125.226.92 and http://74.125.226.34/ are Google for sure. ;)

It's either related to Google Updater or Google Instant, just to keep a connection with Google open...

share|improve this answer
    
Thanks Tom, but what about the others as logged in pastebin.com/69JSMF7K? Any idea why those might be there? –  nmc Jul 2 '11 at 14:02
    
@nmc: No idea, might or might not be Google. Can't tell... –  Tom Wijsman Jul 2 '11 at 14:08
add comment

Are you sure that it is keep-alive? Every keystroke entered in the browser or a search box is sent to Google as they are typed. Maybe that is what you are seeing. The EULA when you install any Google software also states that searches from all your browsers will be sent and not just Google's. That is then saved on their servers with a unique ID from your computer so they can keep track of which data came from your machine.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.