TCP

Each SYN leaves a half-open connection in SYN-RECEIVED, held in a limited per-port backlog. Spoofed sources never answer, so entries wait out the server's SYN-ACK retries; with the backlog full, new SYNs are ignored or evict others, and real clients' connects stall.

The firewall's idle timer expired and it deleted the connection's state without telling either endpoint, so later segments are dropped or reset. Send traffic more often than that timer: TCP keepalive with a short idle time, or an application heartbeat.

The ACK cannot say which copy it acknowledges, so the RTT is ambiguous; Karn's algorithm discards such samples. The RTO, doubled on each timeout, is kept until new data is acknowledged without retransmission. The timestamp option removes the ambiguity.

Fast retransmit needs later segments to produce duplicate ACKs; a tail loss has too few behind it, so only the RTO, normally at least 1 s (RFC 6298), recovers it. RACK-TLP (RFC 8985) instead probes after about 2 x SRTT.

Endpoints derive MSS from their own 1500-byte links, but tunnel encapsulation shrinks the path MTU, so full-sized segments are dropped and, with ICMP feedback filtered, never shrink. Rewriting passing SYNs' MSS to fit the tunnel stops oversized segments being built.

Cumulative ACKs report only the contiguous prefix, so several losses in one window surface about one per round trip. SACK blocks describe data held beyond the gap but are advisory, so data is freed only once the cumulative ACK passes.

Toward one server socket only the client port varies, and the client, closing first, holds each port in TIME-WAIT for 2×MSL. Ceiling: usable ports divided by that time — 16,384 ports over RFC 9293's 240 s is about 68 per second.

CLOSE-WAIT piles up where the peer has closed but the local application never calls close: almost always a connection leak. TIME-WAIT piles up on the active closer under high connection churn: normal, and it clears itself after 2×MSL.

Each side, in SYN-SENT, receives a SYN without an ACK, moves to SYN-RECEIVED and sends a SYN-ACK repeating its own ISN. Each SYN-ACK moves its receiver to ESTABLISHED: four segments, one connection. RFC 9293 requires every TCP to support it.

Silly window syndrome is a stable TCP pattern of tiny window openings filled by tiny segments. RFC 9293 requires both sides to avoid it: receivers withhold small window increases, senders wait for a worthwhile amount to send.

A UDP socket never listens or accepts: one bound socket trades datagrams with any peer, sendto naming the destination and recvfrom returning one whole datagram and its sender. connect() on UDP sends nothing; it sets a default peer and filters locally.

A 1 Gbps, 100 ms path needs about 8,333 full-sized packets in flight; after halving, Reno adds one segment per round trip, so it needs about 4,167 round trips, roughly 7 minutes. CUBIC cuts less and regrows along a time-based cubic curve.

An RTO built from 80 ms samples sits at the 1 s floor, so a 2 s delay fires it while the originals are merely late. An ACK echoing the original's TSval, or a D-SACK for the duplicate, exposes the spurious timeout.

These options change how the whole connection behaves, so they are offered in the SYN before data flows. Window scale and timestamps apply only if both SYN and SYN-ACK carry them; stripping one from the SYN-ACK leaves the two ends disagreeing.

A TCP receiver sends an immediate duplicate ACK for each segment arriving above a gap, and a reordered segment leaves the same gap as a lost one. Overtaken by three or more segments, it triggers fast retransmit of data that was only late.

An old duplicate segment reaches an endpoint in TIME-WAIT; its ACK reaches a peer with no record of the connection, which answers RST, and the reset ends TIME-WAIT early, exposing a reopened connection to stale segments.