Summary

  • QUIC uses the smaller advertised non-zero idle timeout, then applies a floor of three current PTO periods.
  • The timer restarts on precisely defined receive and send events; not every outgoing packet can refresh it indefinitely.
  • A long QUIC idle value does not reserve UDP mappings, backend affinity, application state or business-session validity.

An operator sees both endpoints advertise thirty minutes and gives the product team a simple answer: an inactive session will survive for half an hour. Ninety seconds after the last exchange, a firewall removes its UDP mapping. The client’s next packet never reaches the backend that still holds the connection. Nothing in the advertised transport parameter promised otherwise.

RFC 9000 §10.1 defines a protocol-state boundary. If either endpoint advertises a non-zero max_idle_timeout, the effective value is the minimum of the two advertisements, or the sole non-zero value when only one side supplies one. Once the connection remains idle beyond the applicable period, the endpoint silently closes it and discards its state.

The word “maximum” matters. The value bounds tolerated idle time; it is not a minimum lease on a working connection. An endpoint that advertises a value commits to initiating an immediate close if it deliberately abandons the connection earlier than the effective value. That obligation does not prevent an application deadline, explicit close, stateless reset, lost route, expired credential or failed intermediary from ending usefulness first.

Timer arithmetic is more selective than a traffic counter. An endpoint restarts its idle timer after receiving and successfully processing a peer packet. It also restarts when it sends an ack-eliciting packet only if it has not sent another ack-eliciting packet since the last peer packet was received and processed. Repeated local transmissions without peer progress cannot be treated as endless extensions. A dashboard that records “last packet sent” is missing the state needed to reproduce the timer.

The configured number is not always the operative expiry. RFC 9000 requires endpoints to raise the idle period to at least three times the current Probe Timeout, or PTO. RFC 9002 §6.2 gives PTO a separate meaning: it triggers probe datagrams when expected acknowledgment has not arrived or address validation remains incomplete. PTO expiry is not itself a loss verdict.

RFC 9002 §6.2.1 computes PTO from smoothed RTT, RTT variation, timer granularity and, where applicable, maximum acknowledgment delay. Consecutive PTOs back off. The three-PTO floor is therefore dynamic. Retaining only the negotiated milliseconds discards the recovery state that can explain the endpoint’s actual expiration boundary.

Liveness traffic is possible, but it is not magic. RFC 9000 §10.1.1 warns that a packet sent close to expiry can arrive after the peer has already discarded state. A PING or other ack-eliciting frame can test liveness when expiry is near. A returned ACK shows a transport exchange; it does not show that the application is healthy, that a login remains valid, or that a transaction can still be safely resumed.

RFC 9000 §10.1.2 allows an implementation to offer idle deferral by sending PING periodically. This can preserve endpoint state when the application expects a quiet interval, but application protocols should decide when it is appropriate. Unnecessary probes consume packets, processing and network capacity, and can harm performance. Keepalive policy is an operational decision, not an automatic conversion of the timeout into guaranteed availability.

The same section makes the path boundary explicit: middlebox state can expire earlier than the negotiated QUIC timer. A NAT, firewall or load balancer owns a different clock. Even when both endpoints retain state, the next packet might encounter a missing mapping or the wrong backend. Endpoint configuration cannot reserve infrastructure it does not control.

RFC 9000 §18.2 says idle timeout is disabled when both endpoints omit the parameter or set it to zero. That disables this QUIC idle mechanism, not every lifetime boundary around the connection. Infinite endpoint patience cannot keep an intermediary mapping, application session or authorization record alive.

The defensible record therefore joins both advertisements, their minimum, current PTO and inputs, the last successfully processed peer packet, the last qualifying locally sent ack-eliciting packet, PING and ACK outcomes, middlebox observations, backend affinity, application expiry and final termination mechanism. One timer owns only one boundary.