I ran Wireshark on my PC and found that my chrome browser was sending LOTS of Keep-alive packets even when there are no sites loaded in the browser, and even when there are no extensions installed!! I don't recognize the IPs that Chrome is trying to contact. Does anyone know what this is all about?

I have three PCs and two out of three exhibit this behavior of sending keep-alive packets. One does not. It's possible that this is due to wireshark settings??

I can post details of the OS, Chrome version and wireshark export for each if necessary but it would get pretty long. So, please let me know if there is any other info I should post that would help determine the cause of this.


This is embarassing. I can't seem to replicate the problem on either PCs right now! I saved my earlier wireshark logs as .txt files so I'm running wireshark again to capture some .pcap files and I'm not seeing the problem! I get pairs of random keep-alive packets as opposed to 35+ in a row as previously. See http://cloudshark.org/captures/12d73929a99f for what I can log at time of this edited posting.

Earlier text output can be seen at http://pastebin.com/69JSMF7K

Would there be any specific reason that these keep-alive packets happen more often during certain times of the day?

  • I'd be interested in seeing the packet trace. Can you maybe post it to CloudShark and just post the link here?
    – Spiff
    Jun 26, 2011 at 1:06
  • @Spiff: Edited my post above with some additional info.
    – nmc
    Jun 26, 2011 at 2:30
  • @nmc Thanks for the traces. They were interesting to analyze, but I'm stumped. It did seem like most of the addresses they were sending keepalives to were owned by Google. (Tip: When reverse DNS lookups fail, use whois.)
    – Spiff
    Jun 26, 2011 at 4:39
  • What process was the source, Chrome.exe? Could it have been the update function? Try opening the About dialog and see if it does it again (especially if you can do so with a version that is behind the current one).
    – Synetech
    Jun 26, 2011 at 19:17
  • 1
    @nmc: I don't see any don't in It did seem like most of the addresses they were sending keepalives to were owned by Google... Jul 2, 2011 at 20:51

3 Answers 3


You may want to check out this article regarding keep-alive timeouts:

Interestingly one of the other things I noticed while doing this test with Wireshark is that after 45 seconds, Chrome would send a TCP keep-alive packet, and would keep doing that every 45 seconds until the 5 minute timeout. No other browser would do this.

My guess would be that Chrome had opened a connection to the Google Instant server (probably as soon as you typed something in the browser bar) and then is sending the keep-alives to keep the connection open until the browser is finally closed. As mentioned in the article above, many NAT routers will close an idle connection after 2 minutes so various browsers will send keep-alives on intervals shorter than that to keep connections open.


@Sathya: I don't think so. My version is up to date and as Spiff said, the IPs don't appear to belong to Google. – nmc 2 days ago

Erm... and are Google for sure. ;)

It's either related to Google Updater or Google Instant, just to keep a connection with Google open...

  • Thanks Tom, but what about the others as logged in pastebin.com/69JSMF7K? Any idea why those might be there?
    – nmc
    Jul 2, 2011 at 14:02
  • @nmc: No idea, might or might not be Google. Can't tell... Jul 2, 2011 at 14:08

Are you sure that it is keep-alive? Every keystroke entered in the browser or a search box is sent to Google as they are typed. Maybe that is what you are seeing. The EULA when you install any Google software also states that searches from all your browsers will be sent and not just Google's. That is then saved on their servers with a unique ID from your computer so they can keep track of which data came from your machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .