RFC 6298

Computing TCP's Retransmission Timer

📅 published June 2011, from ietf

Computing TCP's Retransmission Timer 🎀

Okay bestie, this one is RFC 6298, and it's the official rulebook for how TCP figures out its retransmission timer 💖 It was published by the IETF (Internet Engineering Task Force) in June 2011 as a Standards Track document with ISSN 2070-1721, so it's the real deal, not just vibes ✨ The authors are V. Paxson (ICSI/UC Berkeley), M. Allman (ICSI), J. Chu (Google), and M. Sargent (CWRU). Also, it obsoletes RFC 2988 and updates RFC 1122, so it's basically the glow-up of an older spec 🦋

Abstract ✨

Okay so the abstract is the quick tour 🌸 This doc defines the standard algorithm that Transmission Control Protocol (TCP) senders are required to use to compute and manage their retransmission timer. It expands on the discussion in Section 4.2.3.1 of RFC 1122 and upgrades the requirement of supporting the algorithm from a SHOULD to a MUST. It also obsoletes RFC 2988 💅

Status of This Memo 🧚

This is an Internet Standards Track document ✨

It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741 📚

For the current status, any errata, and how to give feedback on this doc, go to http://www.rfc-editor.org/info/rfc6298 🔥

Copyright Notice 💜

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they're your rights and restrictions for this document, no cap 🙈 Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 🫶

1. Introduction 🌸

Okay so TCP (The Transmission Control Protocol) [Pos81] uses a retransmission timer to make sure data gets delivered even when the remote receiver gives no feedback at all. The length of that timer is called the RTO (retransmission timeout) ⏰ RFC 1122 [Bra89] says the RTO should be calculated as outlined in [Jac88], and that's the vibe we're building on 💖

This doc codifies the algorithm for setting the RTO, which is giving official. It also expands on the discussion in Section 4.2.3.1 of RFC 1122 and upgrades the requirement of supporting the algorithm from a SHOULD to a MUST 💅 RFC 5681 [APB09] outlines the algorithm TCP uses to start sending again after the RTO expires and a retransmission goes out. This document does not change the behavior that RFC 5681 [APB09] outlines ✨

Sometimes it might be smart for a TCP sender to be more conservative than what this doc allows 🧸 Still, a TCP MUST NOT be more aggressive than the following algorithms allow. This doc obsoletes RFC 2988 [PA00] too 🦋

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [Bra97] 🔥

2. The Basic Algorithm 🎀

Okay, to compute the current RTO, a TCP sender keeps track of two state variables: SRTT (smoothed round-trip time) and RTTVAR (round-trip time variation) 💖 We also assume a clock granularity of G seconds ⏱️

The rules for computing SRTT, RTTVAR, and RTO go like this 👑

(2.1) Until a round-trip time (RTT) measurement has been made for a segment sent between the sender and receiver, the sender SHOULD set RTO <- 1 second, though the "backing off" on repeated retransmission discussed in (5.5) still applies 🌙

Also, the previous version of this doc used an initial RTO of 3 seconds [PA00]. A TCP implementation MAY still use this value (or any other value > 1 second). This change to the lower bound on the initial RTO is covered in more detail in Appendix A 🍓

(2.2) When the first RTT measurement R is made, the host MUST set:

SRTT <- R
RTTVAR <- R/2
RTO <- SRTT + max (G, K*RTTVAR)

where K = 4 ✨

(2.3) When a later RTT measurement R' is made, a host MUST set:

RTTVAR <- (1 - beta) * RTTVAR + beta * |SRTT - R'|
SRTT <- (1 - alpha) * SRTT + alpha * R'

The SRTT value used in the RTTVAR update is its value from before SRTT gets updated by the second assignment 🧚 So updating RTTVAR and SRTT MUST be computed in the order above 💅

The above SHOULD be computed using alpha=1/8 and beta=1/4 (as suggested in [JK88]) 🫶

After the computation, a host MUST update:

RTO <- SRTT + max (G, K*RTTVAR)

(2.4) Whenever RTO is computed, if it is less than 1 second, then the RTO SHOULD be rounded up to 1 second 🌈

Okay real talk, traditional TCP implementations use coarse-grained clocks to measure RTT and trigger the RTO, and that puts a big minimum value on the RTO 🙈 Research suggests a large minimum RTO is needed to keep TCP conservative and avoid spurious retransmissions [AP99]. So this spec requires a large minimum RTO as a conservative approach 🛡️ At the same time, it admits that someday research might show a smaller minimum RTO is acceptable or even better ✨

(2.5) A maximum value MAY be placed on RTO, provided it is at least 60 seconds 💜

3. Taking RTT Samples 🦋

TCP MUST use Karn's algorithm [KP87] for taking RTT samples. That means RTT samples MUST NOT be taken from segments that were retransmitted, because it's ambiguous whether the reply was for the first copy or a later one 😭 The only time TCP can safely take RTT samples from retransmitted segments is when the TCP timestamp option [JBB92] is in use, since the timestamp option clears up which instance of the data segment triggered the acknowledgment 💖

Traditionally, TCP implementations have taken one RTT measurement at a time (usually once per RTT). With the timestamp option, though, every ACK can be used as an RTT sample 🌸 RFC 1323 [JBB92] suggests that TCP connections with large congestion windows should take lots of RTT samples per window of data, so they avoid aliasing effects in the estimated RTT ✨ A TCP implementation MUST take at least one RTT measurement per RTT (unless Karn's algorithm makes that impossible) 🔥

For fairly modest congestion window sizes, research suggests that timing every segment doesn't lead to a better RTT estimator [AP99] 🧸 Also, when multiple samples are taken per RTT, the alpha and beta from Section 2 might keep an inadequate RTT history. How to change those constants is still an open research question 🔬

4. Clock Granularity 🍓

There's no requirement for the clock granularity G used in computing RTT measurements and the different state variables 🙌 However, if the K*RTTVAR term in the RTO calculation equals zero, the variance term MUST be rounded to G seconds (i.e., use the equation given in step 2.3):

RTO <- SRTT + max (G, K*RTTVAR)

Experience has shown that finer clock granularities (<= 100 msec) perform somewhat better than coarser ones 💅

Also, [Jac88] outlines several clever tricks for getting better precision out of coarse-granularity timers. These changes are widely implemented in current TCP implementations 🌈

6. Security Considerations 🔐

Okay so bestie, this part is serious but it's also kind of iconic, so let's go 💅. This document makes a TCP sender wait a certain amount of time before it retransmits a segment it hasn't gotten an ACK for. An attacker could try to make the sender's RTO super big by adding delay to a timed packet's trip, or to its ACK's trip. BUT, ngl, adding delay usually comes with the power to just drop packets, and dropping some of a connection's packets is already a mess. So it's hard to see what an attacker would gain from this that's worse than plain discarding 🙃

The Internet, like, really depends on the RTO algorithm being done right (along with the ones in RFC 5681) so the network stays stable and doesn't hit congestion collapse 😭 An attacker could make TCP endpoints act more aggressively during congestion by forging ACKs for segments the receiver never actually got, which pushes RTO down to an unsafe value. Main character villain behavior, but it's not easy. Spoofing ACKs correctly is hard unless the attacker can watch the traffic on the path between sender and receiver 👀 Even if they do manage to get the sender's RTO way too small, it doesn't seem like they can do much with it compared to the other damage they could do by spoofing packets from the connection. Why? Because the sending TCP will still back off its timer when a packet it sent wrongly gets lost to real congestion 🦋

The security considerations in RFC 5681 [APB09] also apply to this document, so go read those too, no skipping 📚

7. Changes from RFC 2988 🌸

This document lowers the initial RTO from the old 3 seconds [PA00] down to 1 second. The exception is if the SYN or the ACK of the SYN gets lost. Then the default RTO goes back to 3 seconds before any data gets sent 🧚

8. Acknowledgments 🫶

The RTO algorithm in this memo came from Van Jacobson in [Jac88]. Iconic origin story ✨

A lot of the data that pushed the initial RTO change from 3 seconds to 1 second came from Robert Love, Andre Broido, and Mike Belshe. Thank you, queens 👑

9. References 📖

9.1. Normative References

[APB09] Allman, M., Paxson, V., and E. Blanton, "TCP Congestion Control", RFC 5681, September 2009.
[Bra89] Braden, R., Ed., "Requirements for Internet Hosts - Communication Layers", STD 3, RFC 1122, October 1989.
[Bra97] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[JBB92] Jacobson, V., Braden, R., and D. Borman, "TCP Extensions for High Performance", RFC 1323, May 1992.
[Pos81] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, September 1981.

9.2. Informative References

[AP99] Allman, M. and V. Paxson, "On Estimating End-to-End Network Path Properties", SIGCOMM 99.
[Chu09] Chu, J., "Tuning TCP Parameters for the 21st Century", http://www.ietf.org/proceedings/75/slides/tcpm-1.pdf, July 2009.
[SLS09] Schulman, A., Levin, D., and Spring, N., "CRAWDAD data set umd/sigcomm2008 (v. 2009-03-02)", http://crawdad.cs.dartmouth.edu/umd/sigcomm2008, March, 2009.
[HKA04] Henderson, T., Kotz, D., and Abyzov, I., "CRAWDAD trace dartmouth/campus/tcpdump/fall03 (v. 2004-11-09)", http://crawdad.cs.dartmouth.edu/dartmouth/campus/tcpdump/fall03, November 2004.
[Jac88] Jacobson, V., "Congestion Avoidance and Control", Computer Communication Review, vol. 18, no. 4, pp. 314-329, Aug. 1988.
[JK88] Jacobson, V. and M. Karels, "Congestion Avoidance and Control", ftp://ftp.ee.lbl.gov/papers/congavoid.ps.Z.
[KP87] Karn, P. and C. Partridge, "Improving Round-Trip Time Estimates in Reliable Transport Protocols", SIGCOMM 87.
[PA00] Paxson, V. and M. Allman, "Computing TCP's Retransmission Timer", RFC 2988, November 2000.

Appendix A. Rationale for Lowering the Initial RTO 🎀

Picking a reasonable initial RTO is a balancing act between two things:

The initial RTO should be big enough to cover most end-to-end paths, so you avoid spurious retransmissions and the negative performance hit that comes with them.
The initial RTO should be small enough to make sure recovery is timely when a packet is lost before an RTT sample has been taken.

Traditionally TCP used 3 seconds as the initial RTO [Bra89] [PA00]. This document wants to lower that to 1 second, and here's the reasoning 💖

Modern networks are just faster than the state of the art was when the 3 second initial RTO got defined. Glow-up era 🌈
Studies found that more than 97.5% of the connection round-trip times in a large scale analysis were under 1 second [Chu09], which suggests 1 second meets criterion 1 above 🙌
The studies also saw retransmission rates inside the three-way handshake of roughly 2%. So reducing the initial RTO helps a non-negligible set of connections 📈
BUT, roughly 2.5% of the connections studied in [Chu09] have an RTT longer than 1 second. For those, a 1 second initial RTO guarantees a retransmission during connection establishment, whether it's needed or not 😬

When that happens, this document says to go back to an initial RTO of 3 seconds for the data transmission phase. So the spurious retransmission doesn't cost much: (1) an extra SYN gets sent into the network, and (2) according to RFC 5681 [APB09] the initial congestion window gets limited to 1 segment. Point (2) clearly puts these connections at a disadvantage, but resetting the RTO means the connection won't keep running into trouble with a short timeout. (Of course, if the RTT is more than 3 seconds, the connection will still struggle. But that's not a new issue for TCP 🤷‍♀️)

Also, when timestamps are in use, TCP can take an RTT sample even during a spurious retransmission. That helps it converge on a correct RTT estimate when the RTT is over 1 second ⏱️

As an extra check on the results in [Chu09], we analyzed packet traces of client behavior collected at four different vantage points at different times, as follows 🔍

Name       Dates            Pkts.   Cnns.  Clnts. Servs.
--------------------------------------------------------
LBL-1      Oct/05--Mar/06   292M    242K   228    74K
LBL-2      Nov/09--Feb/10   1.1B    1.2M   1047   38K
ICSI-1     Sep/11--18/07    137M    2.1M   193    486K
ICSI-2     Sep/11--18/08    163M    1.9M   177    277K
ICSI-3     Sep/14--21/09    334M    3.1M   170    253K
ICSI-4     Sep/11--18/10    298M    5M     183    189K
Dartmouth  Jan/4--21/04     1B      4M     3782   132K
SIGCOMM    Aug/17--21/08    11.6M   133K   152    29K

The "LBL" data was taken at the Lawrence Berkeley National Laboratory, and the "ICSI" data came from the International Computer Science Institute. The "SIGCOMM" data is from the wireless network that served the SIGCOMM 2008 attendees, and the "Dartmouth" data was collected from Dartmouth College's wireless network. The latter two datasets are available from the CRAWDAD data repository [HKA04] [SLS09]. The table lists the dates of the data collections, the number of packets collected, the number of TCP connections observed, the number of local clients monitored, and the number of remote servers contacted. We only consider connections initiated near the tracing vantage point 🗺️

Analysis of these datasets finds retransmitted SYNs at a prevalence between 0.03% (ICSI-4) and roughly 2% (LBL-1 and Dartmouth) 📊

We then analyzed the data to figure out how many additional and spurious retransmissions would have happened if the initial RTO had been 1 second. In most of the datasets, the proportion of connections with spurious retransmits was under 0.1%. In the Dartmouth dataset though, about 1.1% of connections would have sent a spurious retransmit with a lower initial RTO. The reason is that the monitored network is wireless, so it's open to extra delays from RF effects 📡

Finally, there are obviously performance benefits from retransmitting lost SYNs with a reduced initial RTO 🚀 Across our datasets, the share of connections that retransmitted a SYN and would get at least a 10% performance improvement from the smaller initial RTO in this document ranges from 43% (LBL-1) to 87% (ICSI-4). The share that would get at least a 50% improvement ranges from 17% (ICSI-1 and SIGCOMM) to 73% (ICSI-4).

From the data we have access to, we conclude that the lower initial RTO is likely to help many connections and hurt relatively few 💜

Authors' Addresses 💌

Vern Paxson
ICSI/UC Berkeley
1947 Center Street
Suite 600
Berkeley, CA 94704-1198

Phone: 510-666-2882
EMail: vern@icir.org
http://www.icir.org/vern/

Mark Allman
ICSI
1947 Center Street
Suite 600
Berkeley, CA 94704-1198

Phone: 440-235-1792
EMail: mallman@icir.org
http://www.icir.org/mallman/

H.K. Jerry Chu
Google, Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043

Phone: 650-253-3010
EMail: hkchu@google.com

Matt Sargent
Case Western Reserve University
Olin Building
10900 Euclid Avenue
Room 505
Cleveland, OH 44106

Phone: 440-223-5932
EMail: mts71@case.edu

That's the whole RFC, bestie 🌈💖 You made it through the RTO timer, the security stuff, and the appendix! Go touch grass and then reread it, no cap 🦋✨

📦 where this page comes from

ietf: rfc6298 2011-06
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms