# TCP sequence space and modern 1 gigabits/sec switches?

A modern world is full of gigabit/sec switches.

There are 2^32 octets (bytes) of the sequence space as per TCP standard.

Let's calculate. 1_000_000_000 is 125_000_000 bytes. Conceptually, each byte within the established TCP connection has its own unique sequence number; uniqueness is a must here because without it the whole thing just malfunctions. So, (2^32) / 125_000_000 yields approx. 35 seconds. In other words, a modern gigabit/sec switch/network can exhaust the whole sequence space in half a minute.

To me, it sounds extremely unsafe with respect to the core assumption about the uniqueness of the sequence number. How can we guarantee that within these 35 seconds an assumed "old" packet with some sequence number `X` will die and no conflict between the old one and a new one will pop up all of a sudden? At which level of OSI does this guarantee live, if it does exist in the first place?

Just for the clarity sake, I gonna quote the TCP RFC:

Under normal conditions, TCPs keep track of the next sequence number to emit and the oldest awaiting acknowledgment so as to avoid mistakenly using a sequence number over before its first use has been acknowledged. This alone does not guarantee that old duplicate data is drained from the net, so the sequence space has been made very large to reduce the probability that a wandering duplicate will cause trouble upon arrival. At 2 megabits/sec. it takes 4.5 hours to use up 2**32 octets of sequence space. Since the maximum segment lifetime in the net is not likely to exceed a few tens of seconds, this is deemed ample protection for foreseeable nets, even if data rates escalate to l0's of megabits/sec. At 100 megabits/sec, the cycle time is 5

• This question is probably more on-topic at Network Engineering; please delete it here if you post it there. Dec 30, 2021 at 13:05
• "A modern world is full of gigabit/sec switches." – Funny. In my job, the world is full of 100G switches with 400G uplinks. Dec 30, 2021 at 13:44
• @JörgWMittag lol, technically 100GBits switch belongs to the set of 1GBits switches :) Dec 30, 2021 at 13:59

The gigabit speed is throughput, but it tells you nothing about buffer depth or packet lifetime. To some extent, higher throughput switches result in shorter packet lifetimes, as under normal circumstances the packet will be delivered to its destination (or dropped) faster.

In order for the sequence number to be a problem you would have to:

• have a packet with sequence number X

• duplicate it, with one copy being buffered somewhere and the other arriving at the destination

• another 4GB of data is transmitted in the same TCP stream to the destination

• then transmit the buffered packet to the destination

This is unlikely because systems that buffer tend to buffer in-order. It's difficult to see what sort of intermittent fault would allow 4GB to be transmitted while also routing rogue packets into a sufficiently long/deep delay somewhere for one to arrive as a duplicate.

It's not hard-guaranteed that there will never be a duplicate. It's just sufficiently unlikely as to not cause problems in normal operation. Note that it's theoretically possible for malicious actors to inject packets with targeted sequence numbers if they've seen the other packets in the connection - and sometimes by guessing the sequence number from other connections.

This is another benefit of encryption everywhere, because if you do MAC-then-Encrypt (like TLS) corrupted data on the wire will result in a decryption failure, so you can then tear down the connection and recover at the application layer (e.g. retry the operation).