TCP doesn't know the path's capacity — it has to discover it by probing. Congestion control is that probe, and it lives entirely in the kernel of both endpoints. The story is the window (cwnd): how many unacknowledged bytes the sender is willing to have in flight.
A fresh connection starts with cwnd = 10 segments (Linux default, 1460 bytes each — the RFC 6928 recommendation). The sender injects 10 segments (~14.6 KB) into the network without waiting for ACKs. This is slow start: the sender is deliberately under-utilizing the link until it learns the real capacity.
Each ACK that arrives increases cwnd by one segment. Since 10 segments were in flight, the first 10 ACKs double the window to 20, then 40, 80 — exponential growth, one round trip per doubling. On a 40 ms RTT link, cwnd passes 1 MB in about 7 RTTs (~280 ms). This is the ACK clock: the network's own acknowledgments pace the sender.
Growth is exponential until cwnd hits ssthresh (initialized to a huge value, often 2^31 or the configured max). Past ssthresh, the sender switches to congestion avoidance: one segment per RTT, linear growth. The kernel tracks this with a per-connection counter; nothing outside the kernel knows or cares.
Now the interesting event: a packet is lost. The sender detects it via three duplicate ACKs (fast retransmit) or a timeout. The response, per the classic Reno-style algorithm: ssthresh = cwnd / 2, cwnd drops to the new ssthresh, and the sender retransmits the missing segment. A 1 MB window halves to 500 KB in one event — a single loss can erase half a second of slow-start growth.
ss -tin | grep -E "cwnd|cubic|bbr"The connection settles into the sawtooth: linear growth until a loss, halving, growth again. In steady state a long-lived flow spends most of its time near its loss-triggered ceiling. The observed throughput roughly follows cwnd / RTT — which is why the same connection is 10× faster on a 10 ms RTT link than a 100 ms one even with identical cwnd.
What the machine actually does is a closed feedback loop: send, count ACKs, double, probe, halve. The entire algorithm is a handful of integers (cwnd, ssthresh, RTT) updated on every ACK in the hot path — nanoseconds of work per packet that collectively decide how fast the internet lets you go.