DPD

networkingsecurity

Stands for: Dead Peer Detection (IKE/IPsec liveness)

Dead Peer Detection - how an IPsec endpoint learns its IKE partner is gone: an on-demand are-you-there exchange, so dead tunnels get torn down and failover can happen.

IPsec tunnels fail silently: packets simply stop arriving, and without liveness checks a gateway will happily encrypt into a void for hours. DPD (RFC 3706, from the IKEv1 era) replaced wasteful periodic keepalives with an on-demand design - only when traffic is outbound and nothing has been heard back does the peer send an R-U-THERE notification and await the acknowledgment; a few misses and the security associations are torn down, freeing the tunnel to re-establish or fail over. IKEv2 built the equivalent liveness check into its informational exchanges, but the DPD name survives in vendor UIs and tunnel configurations everywhere - usually as an interval, a retry count, and the eternal judgment call between detecting failure fast and flapping on a lossy WAN.

Also known as: dpd, dead peer detection, r-u-there, ike keepalive

← All glossary entries