This question already has an answer here:

So, about Heartbleed again, why does SSL/TLS allow the client to specify the message and its length in the heartbeat requests, rather than sending a simple ping?

marked as duplicate by TildalWave, Rory Alsop Sep 28 '14 at 9:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from crypto.stackexchange.com Sep 27 '14 at 22:15

This question came from our site for software developers, mathematicians and others interested in cryptography.


Heartbeat requests are intended for use with connectionless SSL over UDP. A simple ping tells you only that the computer at the other end is up (or not); by including a payload, a program can associate heartbeat requests with specific transactions, detect dropped or out-of-order replies, and do other things that a simple "are you there?" can't do.

That said, I suspect the real reason that heartbeat requests have a payload is that they were modeled on ICMP "echo" requests, without understanding why ICMP echo permits a payload. The ICMP echo payload is intended for low-level network troubleshooting.