Once a healthcheck is scheduled, the TCP connection remains open during all the lead of the Marathon instance.
This has a LOT of drawbacks.
For ex, processes that leak memory for each connection, but are not properly OOM killed (well sized JVM Heap, etc.), won't die but will refuse new connections, and in Marathon all will be completely green.
I know that the path is to move from Marathon to Mesos healthchecks, but apparently even 1.4.3 doesn't provide the MESOS_HTTP or MESOS_TCP healthcheck method (at least in the UI, it seems documented in the API, but if not in the UI then end-users will be lost if they use it to create/update apps).