TCP keep alive works by re-sending the previous ack, even though no more data has been received. There is normally no response for ack packets with no data, but for keep-alives servers respond by also re-sending the previous ack. https://github.com/wireshark/wireshark/blob/178e7ce9a533ba9e5e152c9f7bc08f5ba8f25f0b/docbook/wsug_src/WSUG_chapter_advanced.adoc #networking