Summary

  • RFC 6298 derives the retransmission timeout from smoothed round-trip time and its variation, while refusing ambiguous samples that could teach the estimator the wrong transmission.
  • The first decision may begin at one second, but a lost SYN restores three seconds for data, and every later expiry doubles the timeout before another attempt.

Silence is weak evidence. A segment may be lost, the ACK may be lost, or either packet may simply be slow. Retransmitting too early creates a duplicate and adds traffic to a path that may already be congested. Waiting too long leaves a real loss unrepaired. The retransmission timeout, RTO, is TCP's rule for choosing between those errors without pretending to know which event occurred.

The estimate carries both time and uncertainty

Before any round-trip sample exists, RFC 6298 says the sender should set RTO to one second, though a more conservative value is allowed. After the first measurement R, it sets SRTT = R, RTTVAR = R/2, and RTO = SRTT + max(G, 4*RTTVAR), where G is clock granularity.

Later samples update variation before the smoothed time: RTTVAR uses the old SRTT, with beta one quarter, and SRTT then uses alpha one eighth. The order matters because the variation calculation asks how surprising the new sample was relative to the prior estimate. The resulting RTO is again SRTT plus the greater of clock granularity and four times variation.

The computed value should be rounded up to one second if it is smaller. An implementation may cap the maximum only at 60 seconds or more. These bounds express the RFC's posture: implementations may be more conservative, but must not retransmit more aggressively than the specified algorithm.

Not every ACK teaches the clock

RFC 6298 requires Karn's algorithm. An ACK received after a retransmission is ambiguous: it may acknowledge the first copy or the retransmitted one. The sender must not turn that ACK into an RTT sample unless the TCP Timestamps option removes the ambiguity. Without timestamps, at least one measurement per RTT should be taken; timestamps can expose many more samples, but they do not cancel the estimator's stated rules.

This is distinct from PAWS. RFC 6298 refers to timestamps only as a way to identify which transmission produced an ACK. It does not use them to reject wrapped sequence numbers.

One timer, earliest outstanding data

When new data is sent and the retransmission timer is not running, the sender starts it with the current RTO. An ACK covering all outstanding data stops it. An ACK that advances the acknowledged frontier while data remains outstanding restarts it at the current RTO.

If the timer expires, TCP retransmits the earliest unacknowledged segment, doubles RTO, and restarts the timer with the doubled value. Exponential backoff makes repeated silence progressively more expensive to act upon. A later clean RTT measurement can bring RTO back down; after several backoffs, an implementation may discard SRTT and RTTVAR because those estimates may no longer describe the path.

The one-second initial value has a specific exception. If a SYN times out while the implementation is using less than three seconds, RTO must be reset to three seconds when the connection is established and data transmission begins. The faster opening assumption is withdrawn after the path disproves it.

A timer is a control, not a diagnosis

An attacker can delay a timed packet and inflate RTO, or attempt to drive it downward with forged traffic. The smoothing and backoff rules limit persistence, but they do not authenticate delay. Operators should therefore read an RTO expiry as an action taken under uncertainty, not proof that a particular packet was lost.

The sole source is RFC 6298, published on the Standards Track in June 2011. It defines the normative timer algorithm and its historical rationale. It does not establish current implementation defaults, path RTT distributions, or vendor behavior.