Heartbeat traffic is periodic network communication sent by a device, agent, or service to indicate that it is online, reachable, and functioning. It is common in cameras, embedded systems, remote management tools, and cloud-connected appliances. A heartbeat may carry a simple status flag, device ID, time stamp, or configuration check, and it often occurs at fixed intervals.
In cyber security, heartbeat traffic matters because it helps defenders detect outages, dead agents, and failed links, but it can also reveal the presence of a system and the timing of its activity. Attackers may imitate or abuse heartbeat channels to hide command-and-control traffic, maintain persistence, or blend malicious egress with normal device behavior. Defenders therefore monitor heartbeat destinations, frequency, and payloads, and they compare them against approved vendor services to spot misconfigurations, unauthorized connections, or suspicious changes.