This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Zero window error

0

I am getting a zero window error from a copier, I'm sorry 2 copiers and 1 printer, this did not occur before changes were made to the customers network. They replaced the nic in the printer to resolve the problem. my question is what could have caused the failure of the 3 nics if they are infact the cause of the zero window error

asked 12 Oct '12, 11:58

aPauling's gravatar image

aPauling
1111
accept rate: 0%


3 Answers:

1

I can send you a network analysis report from an IT company that says I need to replace the printers

just an idea. Did they upgrade the network (where the printers are located) from 100 MBit to gigabit? That could cause an older printer to get "overwhelmed" by the amount of data coming through the gigabit network and thus leading to a full buffer problem much often than before (slow CPU, small buffer).

Regards
Kurt

answered 13 Oct '12, 01:34

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

0

"Zero Window" is not really an error, it is more of a "stop signal". You could argue that a signal like that is quite unwanted (just like an error) :-)

As I already commented in the older post you also asked about this I have seen printers use zero window signaling to slow down/stop transmission from print servers/workstations while they're busy waking up and spinning up their internal mechanical parts. When ready, the zero window is pulled up to signal that the sender may continue. It's like a "wait a second, need to get running first... okay, send".

Without a tracefile I can't check what is really happening, but it is kind of surprising that replacing a NIC would help here, since the TCP window signaling is not something that depends on the NIC, but the TCP stack.

answered 12 Oct '12, 14:10

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

I can send you a network analysis report from an IT company that says I need to replace the printers

(12 Oct '12, 15:13) aPauling

0

As @Jasper said, zero window from printers as a signaling mechanism is fairly normal. As @Kurt said, a modern PC on a fast network can throw data at an older printer faster than the printer can accept it.

In all this discussion of zero window packets, there is one thing you haven't mentioned: Is printing working normally?

If the printers are working the way they always have, and you're happy with the print output speed, then zero window can be considered a cosmetic error and disregarded. If the printers are working the way they always have, but you're not happy with the print output speed, then you've outgrown these printers and you need to upgrade to newer, faster printers.

If, as we suspect, this is just a case of older, slower printers on a newer, faster network, then this is what you should see:

First, a fairly steady stream of data to the printer, but with the printer's remaining window size continuously decreasing as it receives data faster then it can process it. At some point, the printer's receive buffer will fill, it will send a zero window, and data transfer will stop. As the printer continues printing, it will keep pulling data from the receive buffer, and when there is room for more incoming data, it will send a window update and data transfer will resume. The data transfer will start and stop like this repeatedly until all the data has been transferred. However, the print output should run more or less continuously. Without Wireshark, you would be unable to tell that the data transfer starts and stops.

This process of data transfer stopping and starting--zero window followed by window update--is a normal part of TCP operation when a slower device with limited buffer space is receiving data from a faster device.

answered 13 Oct '12, 10:25

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%