Link monitoring and dead peer detection are the mechanisms by which a router or VPN endpoint actively checks whether the far end is still there, rather than passively assuming the connection is fine until traffic fails. They are the trigger that turns a redundant backup link from a piece of hardware you paid for into an actual failover that fires when the primary path dies. This guide explains how active probing works, why it detects failures far faster than waiting for a timeout, and how it drives the diverse-path and cellular failover that keeps remote sites connected.
Link Monitoring in one line: Link monitoring is the practice of a network device continuously probing a path or peer - by pinging a target, running an uplink health check, or exchanging keepalive messages - to determine whether the connection is genuinely alive. Dead peer detection, or DPD, is the specific version used on VPN tunnels, where each end periodically checks that the other is still responding and tears down or fails over the tunnel when it goes silent. Both exist to detect a dead path proactively and trigger failover, instead of passively waiting for traffic to time out.
The naive way to notice a dead link is to wait until something you send fails to get a response and eventually times out. The problem is that this is slow and unreliable. A link can be physically down while the local interface still shows a carrier - a cellular modem can hold its radio connection while the path beyond it is broken, or a VPN peer can vanish while the local tunnel state still looks established. Passive detection often does not react until an application-level timeout expires, which can be many seconds or longer, and during that whole window traffic is being sent into a black hole.
Active probing solves this by generating its own test traffic on a regular cadence. The device pings a known-reachable target across the link, or sends explicit keepalive messages to the peer, and watches for the replies. When a configured number of consecutive probes go unanswered, the device declares the path dead and acts immediately, without waiting for real traffic to fail. Because the probes run continuously in the background, a failure is caught within a bounded, predictable time rather than whenever the next real packet happens to be sent.
Tuning the probe interval and failure threshold is the core design decision. Frequent probing with a low threshold detects failures very quickly but risks declaring a healthy link dead on a brief burst of packet loss, which is common on cellular and radio. Infrequent probing with a high threshold is stable against noise but slow to react. The right settings depend on the link: a marginal wireless uplink needs enough tolerance to ride out normal jitter, while a critical path might justify aggressive probing to fail over in seconds.
Dead peer detection is the standardized form of this idea applied to VPN tunnels. A VPN can appear up on one end long after the other end has crashed, rebooted, or lost its connection, because the local tunnel state is just a record that does not automatically know the peer is gone. Traffic sent into such a zombie tunnel is silently dropped. DPD prevents this by having each peer periodically confirm the other is still alive, typically by sending a query and expecting an acknowledgement, and treating a run of unanswered queries as evidence the peer is dead.
When DPD declares the peer dead, it does the cleanup that makes recovery possible. It tears down the stale tunnel so the local end stops trusting a connection that no longer works, and it clears the way to re-establish the tunnel - either to the same peer once it returns or to a backup peer over a different path. Without DPD, a failed tunnel can linger as an established-looking state that quietly swallows traffic until something forces a renegotiation, which may not happen on its own for a long time.
The interaction with failover is the whole point. On a site with a primary and a backup connection, DPD or link monitoring is what tells the router that the primary tunnel is truly gone, which is the event that triggers the switch to the backup. A backup link that is never exercised is worthless if nothing detects the primary's failure; the detection mechanism is what converts standby redundancy into working, automatic recovery.
On remote oil and gas sites, connectivity redundancy usually means two diverse paths - for example a primary wired or satellite link and a cellular backup, or two cellular carriers - and the value of that diversity depends entirely on failing over quickly and cleanly when one path dies. Link monitoring is the trigger. The router probes the primary path continuously, and the moment the probes stop being answered, it declares the path dead and routes traffic over the backup, ideally before operators or the SCADA system notice anything more than a brief gap.
For a cloud SCADA deployment such as Merobix, this matters because the platform's picture of a site is only as continuous as the link underneath it. Fast, active link monitoring shortens the window in which a site goes silent, which in turn shortens or avoids a comms-fail alarm and keeps buffered data gaps small. A router that fails over in a few seconds on a monitored path produces a far more continuous data stream than one that waits for a slow passive timeout while readings pile up in the field buffer.
Getting the detection right is as important as having the redundancy at all. Probe too aggressively on a noisy cellular link and the router flaps back and forth between paths on normal packet loss, which is worse than a clean single link. Probe too slowly and the redundancy barely helps, because the switch happens long after the outage began. The practical goal is a probe cadence and threshold matched to each path's normal behavior, so failover fires promptly on real failures and stays put through the ordinary jitter that field links always carry.
Passive detection is slow and often does not fire until an application-level timeout expires, which can be many seconds while traffic is silently lost into a dead path. A link can also appear up locally - a modem holding its radio, a tunnel showing established - long after the far end is actually gone. Active probing sends its own test traffic on a fixed cadence, so a failure is caught within a bounded, predictable time rather than whenever the next real packet happens to fail.
They are the same idea at different layers. Link monitoring is the general practice of a router probing a path, often by pinging a known target or running an uplink health check, to decide whether it is alive. Dead peer detection is the specific mechanism on a VPN tunnel where each end periodically confirms the other is still responding and tears down or fails over the tunnel when it goes silent. Both exist to detect a dead path proactively and trigger failover.
On a site with a primary and a backup path, the router probes the primary continuously, and when a set number of probes go unanswered it declares that path dead and switches traffic to the backup. The detection is what makes the redundancy real: a standby link is useless if nothing notices the primary has failed. Tuning the probe interval and failure threshold to each path's normal noise level is what keeps failover both prompt on real outages and stable through ordinary jitter.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.