What is TCP keep-alive and how does it work?

TCP keep-alive sends probe packets to verify connection is still active when idle. Default is typically 2 hours before probing. Purpose: detect dead connections, prevent NAT/firewall timeout. Parameters: keep-alive time (idle before probing), interval (between probes), count (probes before closing). Application-level heartbeats are often preferred for more control. In HTTP, Connection: keep-alive reuses TCP connection for multiple requests (different concept). Balance between detecting failures and overhead.