Summary

  • TCP quiet time applies when a restarting host has lost knowledge of sequence numbers used on active connections; it is not a pause required after every reboot.
  • RFC 793 used one maximum segment lifetime of silence to let the old sequence-space footprint drain before new segments could overlap it.
  • RFC 9293 retains the safety rule but says its error-prone conditions are sufficiently unlikely to ignore in most current implementations.
  • Retained sequence memory removes the need to wait, while timestamps and PAWS provide different receiver-visible evidence against old duplicates at high rates.

A clean restart with an unclean network

When a host crashes, its memory and the network do not fail together. Volatile connection state can disappear immediately while segments emitted before the crash remain in queues, paths or receivers. A restarted TCP may therefore see a blank local table while the network still carries fragments of its earlier history.

A TCP connection is identified by its endpoint addresses and ports. Those values can recur, while sequence numbers provide the evidence used to distinguish data within successive connection instances. The 32-bit sequence space also cycles. Safety depends on old data leaving the network before a later connection using the same identifying tuple assigns overlapping sequence numbers to new data.

RFC 793 framed the problem around lost evidence. Under normal operation, the sender knows the next sequence number on each connection. After a crash that erases that knowledge, it may recreate an earlier connection and choose an initial sequence number equal or close to one used before the failure. An old duplicate arriving at the new receiver can then occupy plausible sequence space. The receiver may accept old bytes as new, or reject new bytes because they appear to duplicate the past.

The mechanism does not require an attacker, corrupted storage or a broken checksum. It requires a particular conjunction: connection identifiers are reused, the sender has forgotten its recent sequence history, recovery is quick, and old duplicates have not yet drained.

Silence as replacement evidence

RFC 793's answer was the quiet-time rule. A TCP starting or recovering after losing memory of sequence numbers in use was to wait one maximum segment lifetime before assigning sequence numbers and emitting segments. The specification took MSL as two minutes, while describing that value as an engineering choice rather than a measured constant of every network.

The wait converts an unknown state into an elapsed-time claim. The restarted host cannot enumerate which old segments remain or which sequence numbers they occupy. After an MSL, the protocol assumes those segments can no longer survive in the network. Only then does the host speak again without needing the missing per-connection record.

RFC 793 described each emitted segment as occupying a block in sequence-number space and time. Data octets consume consecutive sequence numbers, and SYN and FIN consume sequence space as well. A crash leaves the host unable to locate the footprint it created. Starting a new connection too soon can cause that new footprint to overlap the old one.

Quiet time is thus not a congestion backoff, retransmission interval or application timeout. It neither estimates round-trip time nor waits for an acknowledgment. It protects the boundary between two connection histories when the sender no longer possesses the state needed to separate them.

The condition hidden inside the rule

The original specification did not say that every restart must always be followed by two minutes of silence. Its condition was loss of sequence-number knowledge. If a reinitialized endpoint retained its memory of recently used numbers, it did not need to wait; it needed to ensure that newly selected numbers were beyond those recently consumed.

Elapsed uptime supplies another boundary. Even when a host chooses to observe quiet time, the wait is unnecessary after it has already been up for at least an MSL. By then, potentially old segments from before recovery have had the assumed lifetime in which to drain.

RFC 793 also acknowledged an explicit risk choice. Implementers or users could avoid the wait, but only by accepting the possibility that receivers might confuse old and new packets. The rule was therefore both a safety argument and an operational tradeoff: availability immediately after restart versus evidence that old sequence space was no longer live.

What the current specification kept—and qualified

RFC 9293 retains the quiet-time sections in the consolidated TCP base specification. It again says that endpoints recovering after loss of sequence-number memory must remain quiet for an MSL, and that hosts which lose knowledge of the last sequence numbers sent on active connections shall delay TCP transmission for at least the agreed MSL.

The same document also makes a historical judgement. It calls the corruption scenario theoretical, says the discussion remains for situations where it may matter, and states that the risky conditions are sufficiently unlikely to ignore in practical Internet use today. It gives three reasons: initial sequence numbers and ephemeral ports are randomized; the Internet's effective MSL has declined as links became faster; and reboots often take longer than an MSL anyway.

Those statements narrow deployment relevance without erasing the mechanism. The safety claim asks what must be true when sequence history is genuinely lost and identifiers might be reused before duplicates expire. The operational claim says that the whole conjunction is uncommon in most current implementations. Treating the second as a formal repeal would discard the very boundary the document continues to explain.

Randomness, memory and timestamps are different controls

Randomized initial sequence numbers reduce the chance that a restarted connection lands on old occupied sequence space. Randomized ephemeral ports reduce the chance that it recreates the same endpoint tuple. Both make the collision scenario less likely, but neither is identical to remembering which sequence numbers were actually used.

This separates quiet time from ISN randomization. Randomization lowers the probability of landing on old occupied space but does not preserve the sender's actual sequence history. Quiet time instead waits until a possibly occupied footprint is presumed dead.

RFC 9293 identifies another boundary at high data rates. A 32-bit sequence space can cycle rapidly, so TCP timestamps and Protection Against Wrapped Sequences provide receiver-visible evidence for detecting and discarding old duplicates. PAWS is not startup silence. It is a different way to preserve discrimination when time and throughput make sequence-number wrap a live concern.

Sources