Summary

  • The Packet Number field is a protected 1-to-4-byte truncation, not necessarily the full integer.
  • Reconstruction depends on direction, packet-number space and the largest successfully processed number in that space.
  • A repeated low-order value, gap, wrap or failed decryption alone cannot establish loss, replay, attack or application impact.

A passive capture often invites a deceptively tidy conclusion. It sees two protected headers with the same apparent 16-bit value, or observes a large numeric jump after decoding a field, and turns that observation into “millions of lost packets” or “replay.” RFC 9000 and RFC 9001 require a more disciplined account. A QUIC packet number is an integer from 0 through 2^62-1, but the Packet Number field transmitted in a protected long or short header contains only 1 to 4 bytes of its least-significant bits. Header protection also masks the field and the Packet Number Length bits.

The on-wire bytes, the clear truncated value and the reconstructed full number are three different evidence states.

Packet-number identity is scoped. QUIC maintains separate spaces for Initial, Handshake and application data; the latter includes 0-RTT and 1-RTT. Numbers begin at zero in every space. The sender and receiver also maintain separate state by direction. Thus, the same integer may be meaningful for different packets, and no arithmetic across spaces or directions produces a global connection ordinal. Retry and Version Negotiation packets do not carry packet numbers and are not acknowledged through ordinary ACK frames.

The sender’s compact encoding is stateful. Before it has received an acknowledgment in a packet-number space, it sends the full packet number rather than applying the truncation procedure. Once acknowledgment exists, it chooses enough encoded bits to cover more than twice the difference between the packet being sent and the largest acknowledged packet number. The RFC’s sample method may choose a byte length from contiguous unacknowledged numbers; that example illustrates the algorithm, not a production timing rule or a guarantee that every delayed packet will decode.

The receiver must first remove header protection. Only then does it know the clear truncated value and the protected length. It uses three inputs for the sample reconstruction algorithm: the largest packet number successfully processed in the current space, the truncated value and the field’s bit length. The next expected number is the highest successfully received number plus one. Among candidates in the encoding window, the receiver chooses the value closest to that expectation. The result is stateful reconstruction, not a lookup that an observer can perform from bytes alone.

That window explains delayed-packet ambiguity. If a packet arrives after many higher-numbered packets have been received, the same low-order bits can be associated with a candidate that is not the sender’s intended full number. A deprotection or authentication failure therefore is not, by itself, proof of a peer protocol error or attack. The receiver must remove header protection, recover the number, construct the AEAD nonce with that reconstructed number, and remove packet protection. The unprotected header through the Packet Number is authenticated as associated data. Guessing a number outside that process is not an authenticated decode.

ACKs provide a useful contrast. Largest Acknowledged is a full variable-length integer, not a truncated protected header field. ACK ranges identify packets received and processed in the ACK’s packet-number space. They can establish authenticated endpoint facts after processing, but they do not reconstruct missing passive-capture state or make an ACK in one space apply to another. Duplicate handling likewise follows protection removal and authenticated number recovery; a repeated low-order wire value is not yet an authenticated duplicate.

The evidence ledger should therefore retain connection identity and direction; packet type and space; protected bytes and capture completeness; key context and deprotection success; encoded length and clear low-order value; the current-space largest processed number; the expected value and window; the reconstructed full number and packet authentication; then ACK values and ranges. Loss, retransmission, reordering, replay, injection, attack, path effects and application delivery belong in separate fields. A numeric gap may reflect capture position, sampling, truncation, decryption state or traffic behavior.

The RFCs do not make it a loss declaration.

This boundary is distinct from TR-038 spin-bit sampling, TR-042 key phase, TR-045 ACK delivery semantics, TR-049 packet coalescing and TR-051 PTO probing. Those dimensions may matter in their own analyses, but none changes what a protected truncated Packet Number means here.