Why is the throughput you actually measure usually lower than a link's rated bandwidth, and lower still than goodput?

Bandwidth is the theoretical maximum capacity; throughput is the real bits/sec achieved (cut down by latency, the amount of traffic, and the media type); goodput is lower again because it excludes protocol overhead and retransmissions.

These three terms describe a chain from "best case" down to "useful data":

• Bandwidth — the media's rated capacity, fixed by physical media properties, current technology, and the laws of physics.
• Throughput — the actual transfer rate measured at a point in time. It is almost always less than bandwidth because of latency, the volume and type of traffic, and the devices in between.
• Goodput — throughput minus traffic overhead (protocol headers, acknowledgements, retransmissions). It is the rate of genuinely usable application data.

Mental model: bandwidth is the size of the pipe, throughput is how much water is really flowing, and goodput is how much of that water you can actually drink.

Go deeper:

• Throughput — Wikipedia — why measured throughput falls below rated bandwidth, with a goodput section.

• Goodput — Wikipedia — the usable application-data rate after subtracting overhead and retransmissions.

• Bandwidth (computing) — Wikipedia — bandwidth as the theoretical maximum, the top of this chain.