# TCP: tcp_retransmit_timer: jiffies=12345678, rto=300, retransmits=3, skb lost due to peer not receiving timestamps

- **ID:** `networking/tcp-timestamps-retransmit`
- **Domain:** networking
- **Category:** network_error
- **Verification:** ai_generated
- **Fix Rate:** 82%

## Root Cause

The remote peer is dropping segments with TCP timestamps (RFC 1323) due to a misconfigured firewall or kernel module that strips or invalidates the timestamp option, causing the sender to retransmit indefinitely until the connection times out.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Linux kernel 5.15.0-91-generic | active | — | — |
| Linux kernel 6.2.0-26-generic | active | — | — |
| iptables 1.8.7 | active | — | — |

## Workarounds

1. **Disable TCP timestamps only on the affected interface using iptables: iptables -A OUTPUT -o eth0 -p tcp --tcp-flags SYN SYN -j TCPMSS --clamp-mss-to-pmtu && iptables -A OUTPUT -o eth0 -p tcp -j DROP --tcp-option 8** (75% success)
   ```
   Disable TCP timestamps only on the affected interface using iptables: iptables -A OUTPUT -o eth0 -p tcp --tcp-flags SYN SYN -j TCPMSS --clamp-mss-to-pmtu && iptables -A OUTPUT -o eth0 -p tcp -j DROP --tcp-option 8
   ```
2. **Configure the firewall to allow TCP option 8 (timestamps) through: iptables -A FORWARD -p tcp -m tcp --tcp-option 8 -j ACCEPT** (88% success)
   ```
   Configure the firewall to allow TCP option 8 (timestamps) through: iptables -A FORWARD -p tcp -m tcp --tcp-option 8 -j ACCEPT
   ```
3. **In cloud environments, add a network ACL rule to permit TCP flags with timestamps: e.g., AWS NACL inbound rule: TCP, source 0.0.0.0/0, allow, TCP flags: SYN, ACK, FIN, RST.** (80% success)
   ```
   In cloud environments, add a network ACL rule to permit TCP flags with timestamps: e.g., AWS NACL inbound rule: TCP, source 0.0.0.0/0, allow, TCP flags: SYN, ACK, FIN, RST.
   ```

## Dead Ends

- **** — Disabling timestamps can cause performance degradation in high-latency networks and may not address the root cause if the firewall is stripping them at a different layer. (65% fail)
- **** — This only masks the symptom by allowing more retransmissions; the connection will still eventually time out and the underlying packet drop persists. (85% fail)
- **** — The issue is not driver-specific; it is caused by firewall or middlebox behavior. Downgrading introduces regression risks and rarely solves the problem. (90% fail)