# Removing idle connection **URL:** \ **Category:** Technical Forums\ **Tags:** devops, security, application-delivery\ **Created:** [September 6, 2023, 7:59am UTC](https://community.f5.com/t/removing-idle-connection/73040 "2023-09-06T07:59:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Nat24](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Nat24](https://community.f5.com/u/Nat24)\ **Post date:** [September 6, 2023, 7:59am UTC](https://community.f5.com/t/removing-idle-connection/73040/1 "2023-09-06T07:59:56Z")
Hi Experts, We are in this kind of situation wherein BIG-IP is keeping connections for more than an hour. We found out the reason why BIG-IP is behaving this way is because the server is continuously sending keep-alive packets to BIG-IP and, this is also the reason why TCP timeout is not kicking in. What we want to achieve here is to remove idle connection which doesn’t transmit or send data for a period of time. Is there other timeouts we can utilize like SSL timeout or any settings in SSL or other profiles that can remove or check the existing connection if it’s still in use or not? Or maybe do know some iRule to use in this kind of situation. ---
**Author:** ![Paulius](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/paulius/32/21698_2.png) [@Paulius](https://community.f5.com/u/Paulius)\ **Post date:** [September 6, 2023, 2:04pm UTC](https://community.f5.com/t/removing-idle-connection/73040/2 "2023-09-06T14:04:44Z")
@Nat24 Are you performing SSL termination on the F5 or is it terminated at the pool members? ---
**Author:** ![Nath](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nath](https://community.f5.com/u/Nath)\ **Post date:** [September 7, 2023, 6:06am UTC](https://community.f5.com/t/removing-idle-connection/73040/3 "2023-09-07T06:06:29Z")
SSL termination is done by BIG-IP, the traffic is not HTTP and that is why we are having hard time monitoring the session if there are payload being sent since the start of connection. So basically we just wanted to overwrite the TCP idle timeout session and flush connections that go beyond 30mins since the start of session. ---
**Author:** ![Paulius](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/paulius/32/21698_2.png) [@Paulius](https://community.f5.com/u/Paulius)\ **Post date:** [September 7, 2023, 1:29pm UTC](https://community.f5.com/t/removing-idle-connection/73040/4 "2023-09-07T13:29:53Z")
@Nath I haven’t had the opportunity to do it but you might be able to monitor the connection and when the F5 sees the keepalive flag come across it can set a timer and then kill the connection after a certain time. I do not believe this is the best use of the F5 because it’s unnecessary overhead and is better handled by the server or you can just turn off keepalive if the majority of these connections are just sitting. ---
**Author:** ![Nat24](https://avatars.discourse-cdn.com/v4/letter/n/a3d4f5/32.png) [@Nat24](https://community.f5.com/u/Nat24)\ **Post date:** [September 10, 2023, 4:01am UTC](https://community.f5.com/t/removing-idle-connection/73040/5 "2023-09-10T04:01:51Z")
Thanks Paulius, I think we will just blindly close the session after 30 mins using an iRule. Since we observed that legit traffic with payload only lasts 4-5 seconds per transaction. Hopefully this iRule help/works on our PROD. when CLIENT\_ACCEPTED { set rtimer 0after 900000 {if { not $rtimer} {log local0. "[virtual] - client ip=[IP::client\_addr]:[TCP::client\_port]"drop}} } ---
**Author:** ![Paulius](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/paulius/32/21698_2.png) [@Paulius](https://community.f5.com/u/Paulius)\ **Post date:** [September 11, 2023, 4:15am UTC](https://community.f5.com/t/removing-idle-connection/73040/6 "2023-09-11T04:15:58Z")
@Nat24 The downside to arbitrarily closing tcp connections based on time open is they could be legitimate connections that you’re closing. If you know most users get what they need in 4-5 seconds per transaction I would just turn off keepalive and then you won’t have to deal with reaping connections at all. ---
**Author:** ![PSFletchTheTek](https://avatars.discourse-cdn.com/v4/letter/p/53a042/32.png) [@PSFletchTheTek](https://community.f5.com/u/PSFletchTheTek)\ **Post date:** [September 13, 2023, 3:09pm UTC](https://community.f5.com/t/removing-idle-connection/73040/7 "2023-09-13T15:09:47Z")
I don’t know, but you want something that looks at throughput and possibly when it slows down or stays the same kills it. Rather than just relying on timealone. As  @Paulius  that could cause the users/clients issues up stream. Is there anything the application could do?