Summary

  • TIME-WAIT is a temporal integrity boundary: after an active close, RFC 9293 requires the endpoint to retain state for twice the maximum segment lifetime so packets from the old connection cannot be mistaken for the next one.
  • RFC 1337's assassination chain uses ordinary TCP reactions against that boundary: an old unacceptable segment elicits an ACK, the closed peer returns a RST, and accepting that RST removes TIME-WAIT before its quarantine has elapsed.

The memo demonstrated three possible consequences after a rapid reopen, but only as a tuned existence proof; it did not establish how often modern production networks encounter them.

The quarantine that an old segment could end

A TCP endpoint can know that an application is finished while the network is still carrying copies of the conversation. A delayed data segment may be sitting behind a congested link. An ACK may have been duplicated and reordered. Neither packet understands that the sockets have closed or that the same address-and-port pair may soon name another connection.

TIME-WAIT keeps those two histories apart. The endpoint that actively closes retains a transmission control block after the final exchange instead of treating closure as immediate oblivion. RFC 9293 makes the cost explicit: the endpoint MUST linger for twice the maximum segment lifetime. The clock is not decorative cleanup. It gives an old packet population time to expire before a new incarnation can reuse the same identifying tuple.

RFC 1337 begins with the uncomfortable observation that the quarantine could be destroyed by the very recovery behavior TCP used to deal with stale traffic. Its example needs no attacker who can see the current connection and no reset that arrives with special authority. An old data or ACK segment reaches endpoint A while A is in TIME-WAIT. Because the segment is unacceptable—its sequence number or timestamp belongs elsewhere—A sends an ACK containing its current SND.NXT and RCV.NXT. Endpoint B has already discarded the connection. Seeing an ACK for a connection it does not know, B reflects the surprise as a reset. Under the state-machine rule considered by the memo, A accepts that RST, deletes its TIME-WAIT state and enters CLOSED.

The old segment has therefore manufactured a new control exchange. It does not directly command A to forget the connection. It causes A to speak, and A's accurate reply causes a stateless peer to send the destructive signal. RFC 1337 called this sequence TIME-WAIT assassination.

Assassination is a boundary failure, not yet corrupted application data. The later hazard requires the same connection identity to reopen before the old duplicates have died, and it requires enough overlap between the old and new sequence spaces for a stale packet to look acceptable. When those conditions align, the memo identifies three outcomes. Old data may enter the new byte stream. An old ACK may leave the endpoints permanently disagreeing about connection state under the behavior then specified. Or a stale segment may kill a new connection that appeared to have opened successfully.

Those claims have a deliberately narrow evidence boundary. RFC 1337 reports demonstrations on a stock SunOS 4.1.1 TCP in a simulated environment engineered to duplicate segments massively and tuned to create the necessary coincidences. The document presents the experiments as an existence proof. It does not measure contemporary prevalence, identify a current vulnerable operating system or show that every premature exit from TIME-WAIT produces H1, H2 or H3.

The simplest remedy proposed by the memo follows the meaning of the state: ignore RST while TIME-WAIT is doing its job. With the memo's assumed two-minute MSL enforced, it says that choice avoids all three downstream hazards. Yet even here the language is careful. RFC 1337 is Informational, and it asks for extended production testing to uncover unexpected effects. PAWS is described as only a partial alternative because an ACK generated inside TIME-WAIT can carry a current timestamp and become a “new old duplicate”; widening sequence numbers would not by itself stop the premature state deletion.

The present base TCP specification preserves the operational tension rather than making it disappear. RFC 9293 requires 2xMSL TIME-WAIT, permits carefully conditioned fast reopening, and points to a timestamp-based improvement for busy servers. Its base state-machine text also says that an acceptable RST in TIME-WAIT enters CLOSED and deletes the control block, while a retransmitted remote FIN is acknowledged and restarts the 2xMSL timer. The mechanism therefore asks an architectural question, not merely a timer-tuning question: what evidence is strong enough to end a quarantine whose whole purpose is to outlive unauthenticated old traffic?