This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm having problems with a extremely slow network response from outside websites. In looking at the Wireshark output, I see what seems to be a very large number of "TCP window full" and "Zero window" occurrences. One of the "window full" events shows up as:

15874 141.816990 64.81.159.15 10.138.30.34 TCP 60 http > unet [ACK] Seq=4714197 Ack=17390 Win=17520 Len=0

15875 141.817027 10.138.30.34 64.81.159.15 TCP 1514 [TCP segment of a reassembled PDU]

15876 141.817046 10.138.30.34 64.81.159.15 TCP 1514 [TCP segment of a reassembled PDU]

15877 141.817183 64.81.159.15 10.138.30.34 TCP 60 http > unet [ACK] Seq=4714197 Ack=20310 Win=17520 Len=0

15878 141.817233 10.138.30.34 64.81.159.15 TCP 1514 [TCP segment of a reassembled PDU]

15879 141.817261 10.138.30.34 64.81.159.15 TCP 1514 [TCP segment of a reassembled PDU]

15880 141.817288 10.138.30.34 64.81.159.15 TCP 1514 [TCP Window Full] [TCP segment of a reassembled PDU]

Could these be contributing to the slow network response and if so, what should be my next step in resolving these issues?

asked 15 Jun '13, 11:29

gvsenterprises's gravatar image

gvsenterprises
1111
accept rate: 0%


Window full means that the sender has sent as many bytes as it was allowed to before it has to wait for acknowledgement packets. If the receiver reduces his window size to zero it means "dear sender, STOP sending, I have to process data!", which usually means that it has trouble processing data fast enough. Both Window Full and Window Zero may indicate that you have a problem, usually on the receiving side. It is NOT a network problem, it is a PC/Server problem.

permanent link

answered 15 Jun '13, 11:36

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thank you for the information. Now do I understand correctly that, since these exceptions are happening when browsing websites that otherwise work fine from another location (i.e. my house vs. my office), this problem is more likely a client PC issue at the office and not necessarily a problem on the office network?

(15 Jun '13, 13:56) gvsenterprises

It is usually a client PC problem and not a network problem, yes. So e.g. if a web site works fast at home but not at the office the PC at the office seems to have trouble processing incoming data fast enough when you see Window Full and Zero Window issues.

(15 Jun '13, 14:11) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×55
×7

question asked: 15 Jun '13, 11:29

question was seen: 17,965 times

last updated: 15 Jun '13, 14:11

p​o​w​e​r​e​d by O​S​Q​A