How to Configure TCP Non-SACK RTT Resiliency in Windows 11 Using PowerShell

Modern internet and data centre communication heavily relies on the Selective Acknowledgment (SACK, RFC 2018) extension in Transmission Control Protocol. SACK allows the receiver to inform the sender exactly which non-contiguous packets were received, enabling the sender to retransmit only missing segments rather than re-sending the entire window. However, many legacy enterprise middleboxes, satellite backhauls, industrial automation controllers, older embedded network appliances, and specific VPN tunnels do not support SACK or actively strip SACK-permitted options from TCP SYN packets.

When operating over non-SACK connections, standard TCP stacks calculate round-trip time (RTT) and retransmission timeouts (RTO) with strict, aggressive assumptions. On lossy, high-latency, or jitter-prone links, transient packet reordering causes the sender to misinterpret out-of-order packets as lost packets. This triggers premature retransmission timeouts, collapses the congestion window, and resets legitimate connections. To protect against this instability, Windows 11 provides a dedicated networking feature: Non-SACK RTT Resiliency. Managed through PowerShell’s NetTCPIP module, this setting enforces robust RTT estimation and retransmission smoothing across legacy network paths.

Understanding Non-SACK RTT Resiliency Mechanics

In standard TCP operation without SACK, when an acknowledgment arrives for an older sequence number (duplicate ACK), the sender cannot distinguish between a dropped packet and a packet that was merely delayed or reordered in transit. Standard TCP implementations quickly trigger Fast Retransmit and drop transmission rates.

When NonSackRttResiliency is enabled in Windows 11, the operating system’s kernel TCP stack (tcpip.sys) alters its timing calculations whenever a non-SACK connection is negotiated:

• Conservative RTT Sampling: The stack applies dynamic smoothing factors to round-trip time measurements, preventing micro-jitter from artificially inflating or depressing the calculated RTO.
• Spurious Timeout Mitigation: Increases tolerance for out-of-order ACK arrivals before declaring a packet lost and collapsing the congestion window.
• Stable Slow-Start Transitions: Prevents abrupt slow-start throttling on connections traversing legacy cellular or satellite networks where SACK negotiation failed.

The parameter accepts two boolean states: Enabled or Disabled.

Inspecting Current TCP Settings in PowerShell

To inspect whether Non-SACK RTT Resiliency is currently enabled across your Windows 11 network profiles, launch an elevated PowerShell session (Run as Administrator) and run Get-NetTCPSetting:

Get-NetTCPSetting | Select-Object SettingName, NonSackRttResiliency, AutoTuningLevelLocal, CongestionProvider | Format-Table -AutoSize

To view detailed attributes of the default client profile (Internet) and high-latency mobile profile (Dialup / Compat):

Get-NetTCPSetting -SettingName "Internet" | Select-Object SettingName, NonSackRttResiliency, MemoryPressureProtection, PacingProfile

By default in standard client installations of Windows 11, NonSackRttResiliency is set to Disabled on the assumption that modern peer servers support SACK. However, in environments communicating with legacy remote infrastructure or industrial IoT equipment, enabling this setting significantly improves throughput stability.

Enabling Non-SACK RTT Resiliency Using Set-NetTCPSetting

You can enable resiliency across built-in network templates or custom TCP settings profiles using Set-NetTCPSetting.

Enabling Resiliency on the Internet Profile

To enable Non-SACK RTT Resiliency on the primary internet profile:

Set-NetTCPSetting -SettingName "Internet" -NonSackRttResiliency Enabled

Enabling Resiliency on Compatibility Profiles

If your device frequently connects to remote enterprise branches, legacy VPN tunnels, or satellite uplinks, enable resiliency on the Compat profile:

Set-NetTCPSetting -SettingName "Compat" -NonSackRttResiliency Enabled

Enabling Resiliency Across All TCP Profiles

To enforce Non-SACK RTT Resiliency globally across every configured TCP template in a single pipeline execution:

Get-NetTCPSetting | Set-NetTCPSetting -NonSackRttResiliency Enabled

Verify that the configuration update has been applied:

Get-NetTCPSetting | Select-Object SettingName, NonSackRttResiliency

Verifying SACK Negotiation and TCP Options in Network Traffic

To confirm whether remote peers are actively negotiating SACK or falling back to non-SACK mode, capture a connection handshake using Windows Packet Monitor (pktmon) or PowerShell:

# Add a capture filter for target IP address
pktmon filter add -i 192.168.1.50

# Start real-time packet monitoring
pktmon start --etw -m real-time

# Stop packet monitoring after establishing connection
pktmon stop

Examine the TCP header options in the SYN and SYN-ACK packets. If the SACK Permitted (Option Kind 4) flag is absent from the peer’s response, Windows 11 automatically activates the Non-SACK RTT Resiliency logic for that socket.

Monitoring Retransmissions and Connection Health

After enabling Non-SACK RTT Resiliency, monitor TCP performance counters to verify that retransmission rates decrease and spurious timeouts are eliminated.

Query real-time TCP retransmission and timeout counters using PowerShell:

Get-Counter -Counter "\TCPv4\Segments Retransmitted/sec", "\TCPv4\Connection Failures", "\TCPv4\Connections Reset" -SampleInterval 2 -MaxSamples 5

On legacy links, Segments Retransmitted/sec will show a measurable decline as the stack avoids unnecessary packet re-sends.

Reverting to Default Windows 11 TCP Settings

If your networking environment consists entirely of modern endpoints with verified SACK capabilities, or if network benchmarks require standard RFC retransmission behaviour, revert the parameter back to Microsoft defaults.

Disable the setting across the Internet and Compat profiles:

Set-NetTCPSetting -SettingName "Internet" -NonSackRttResiliency Disabled
Set-NetTCPSetting -SettingName "Compat" -NonSackRttResiliency Disabled

Or revert all profiles simultaneously:

Get-NetTCPSetting | Set-NetTCPSetting -NonSackRttResiliency Disabled

Restart the network adapter via Restart-NetAdapter -Name "Ethernet" to clear active connection timers.