I am learning about DDOS and the techniques to mitigate it. TCP Keepalive is used to check if the other host is still up and if the host does not acknowledge the tcp keep alive message, the connection is terminated.
I am wondering if these messages can be used to mitigate DDOS attacks. The server under attack can reduce the time in which it contacts the client whether it is still up or not. The server can use Unicast Reverse path forwarding to prevent IP spoofing and if the attack is being done from legitimate hosts using botnets, can the server use tcp's keepalive message technique in anyway to close the dead connections and prevent itself from being DDOSed ? Is there a way to detect TCP half open connections and close them using tcp keep alive?