Summary

  • At a calculated 1 Gbit/s, the 1990 RFC 1185 put TCP sequence-number half-wrap near 17 seconds. A delayed duplicate could then arrive wearing a number that looked plausible again.
  • RFC 1323's PAWS compared incoming timestamps with TS.Recent to reject old duplicates within an open connection. After more than 24 days idle, it required the receiver to invalidate that saved reference so a resumed connection would not reject every new segment.

TCP had a four-billion-number address book for bytes. The numbers were designed to circle back. At 56 kilobits a second, a complete trip looked leisurely. By the time engineers considered gigabit paths, a very old packet might arrive while its sequence number had already come around again. The bouncer at the connection's door could see a familiar number and mistake yesterday's visitor for today's.

RFC 1185, published in October 1990, made the speed problem concrete. Its table calculated a half-cycle of the relevant sequence-number space at roughly 17 seconds for a 1 Gbit/s path. The TCP maximum segment lifetime used in the discussion was two minutes. Faster transport shortened the time before the numbered slots repeated; the network could still hold an old segment. The fast-path calculation supplied the reason to add a second clue to the packet.

That clue was a TCP timestamp. RFC 1323, published in May 1992, specified a timestamp option serving two jobs: better round-trip-time measurement and PAWS, Protection Against Wrapped Sequence numbers. For PAWS, the receiver remembered a recent timestamp, TS.Recent, within an established connection. If a newly arrived segment carried TSval lower than that valid saved value, the receiver acknowledged and dropped it. Ordinary TCP window checks still followed for segments that passed the timestamp test. A recycled sequence number could look current; a stale timestamp would expose the impostor.

The timestamps were numbers from the sender's own clock. No shared wall clock had to hang above both endpoints. The sender's values did have to advance monotonically, and the receiver compared them in 32-bit modular arithmetic. TS.Recent also helped the round-trip measurement machinery, an economical reuse of connection state. PAWS applied its check to incoming data and acknowledgments, guarding one open conversation against old duplicates produced during that same conversation.

Then the bouncer's notebook aged. RFC 1323 allowed timestamp clocks between one tick per second and one tick per millisecond. At the fast end, the signed half of the 32-bit timestamp range turns over in about 24.8 days. Imagine a connection that stays open but silent while the sender's clock advances. When traffic resumes after that interval, a genuinely fresh timestamp can compare as lower than the receiver's old TS.Recent. The dutiful filter would discard every arriving segment and freeze the connection. Its evidence of freshness had become stale.

RFC 1323 chose a direct cure: an implementation of PAWS must invalidate TS.Recent after more than 24 days of idleness. When the next timestamp falls below the remembered value, the receiver first tests whether that memory is still valid. If the connection has been quiet too long, the new segment can pass the PAWS check and supply a fresh reference. The ordinary sequence-window rules still decide whether the segment belongs in the connection. The bouncer tears up one old list and keeps checking the door.

The authors considered an occasional keepalive to refresh the record. They chose invalidation because the TCP specification had never required keepalives. The receiver also cannot know the other endpoint's timestamp tick rate, so the threshold uses the worst case. The 24-day clock measures inactivity. A busy connection can keep renewing its reference; a long quiet one needs a way to wake up without its own guard blocking the entrance.

The later RFC 7323 retained this account of outdated timestamps and the 24-day invalidation rule. Its persistence is a reminder of what made the 1992 design clever. PAWS gave a fast network a second coordinate when sequence numbers circled too quickly. It also specified when that coordinate ceased to be trustworthy. The watchman could catch yesterday's packet only if he knew when to throw away yesterday's notebook.