A Formal Analysis of Karn's Algorithm.

The stability of the Internet relies on timeouts. The timeout value, known as the Retransmission TimeOut (RTO), is constantly updated, based on sampling the Round Trip Time (RTT) of each packet as measured by its sender – that is, the time between when the sender transmits a packet and receives a corresponding acknowledgement. Many of the Internet protocols compute those samples via the same sampling mechanism, known as Karn’s Algorithm. We present a formal description of the algorithm, and study its properties. We prove the computed samples reflect the RTT of some packets, but it is not always possible to determine which. We then study some of the properties of RTO computations as described in the commonly used RFC6298. All properties are mechanically verified.