Loss detection is an inference from incomplete evidence

An RTT sample spans a transmission and the acknowledgment used to time it. It includes forward travel, receiver behavior such as delayed acknowledgment, reverse travel, and relevant endpoint scheduling. It is not a one-way propagation measurement. RFC 6298 maintains a smoothed RTT and an estimate of variation, adding a safety margin when computing a retransmission timeout. The smoothing makes the timer less sensitive to one observation, while the variation term gives unstable observations a different effect from consistently high delay. Retain clock granularity and configured limits when reproducing an implementation's decision.

For a subsequent eligible sample, update variation using the old smoothed RTT, then update the smoothed RTT itself. Reversing that order makes the apparent deviation artificially smaller. The conventional coefficients are one eighth for the mean and one quarter for variation. An estimator expression is not yet the effective timer: RFC 6298 recommends rounding computed values below one second up to one second, and allows other conservative choices within its rules. Actual stacks may apply documented alternatives. Label a worked estimate as a specification calculation rather than a universal observed timeout.

Suppose bytes are sent at time zero and retransmitted at 0.8 seconds; an ACK arrives at 0.9 seconds. Without distinguishing information, did the original take 0.9 seconds or the retransmission take 0.1 seconds? Feeding the shorter possibility into the estimator can encourage more premature retransmission. Karn's rule avoids ambiguous RTT samples from retransmitted data unless a mechanism such as TCP timestamps resolves which transmission was acknowledged. A capture can still show both elapsed intervals, but the existence of numbers does not make either one a defensible RTT sample.

When a retransmission timer expires, TCP retransmits under its recovery rules and backs off the timer exponentially. Backoff reduces repeated pressure while feedback is missing; it does not diagnose whether the cause is congestion, a failed link, receiver overload, or filtering. An application's deadline can expire before the transport concludes the connection is unusable. Conversely, abandoning application work does not automatically cancel bytes already sent. Keep separate timestamps for the business deadline, socket closure, timer expiration, and retry attempt so a dashboard does not collapse four different events into a single timeout category.

Later arrivals can generate duplicate cumulative ACKs when an earlier range is absent. Classic TCP fast retransmit uses three duplicate ACKs as a loss signal, allowing recovery before the retransmission timer in suitable traces. Reordering can produce a similar pattern, and short flights may not generate enough later ACKs to trigger it. Modern recovery can use selective acknowledgments and additional time-based logic. Always name the actual algorithm when interpreting a trace. QUIC also has packet- and time-threshold loss detection; its probe timeout sends probes to obtain feedback and is not itself a declaration that every outstanding packet was lost.

The probability lab isolates one reason sparse feedback is possible. Let a trial be a hypothetical later segment's successful independent arrival; change delivery probability and the number of later segments. Predict the chance of zero successful later arrivals by reading the zero-success bar. This is not a duplicate-ACK counter: delayed ACK policies, loss correlation, receiver behavior, and retransmission rules are absent. Use the result to question whether enough evidence can arrive quickly, then return to an actual capture and sender state before deciding which recovery path should have run.