What is the window scaling graph showing exactly and how to use it

The window scaling graph shows what you mentioned in option a.)

The size of the advertized receive window incl. scaling factor.

So, basically the graph tells you how well the receiver can handle the received data.

• a 'flat line' means the receiver did not adjust it's window size, hence it had no problem at all to handle the incoming bytes fast enough.
• an 'oscillating' graph (like a saw tooth) means: The receiver advertized a smaller window size, as it was not able to handle the incoming traffic fast enough, hence the buffer got filled up. By lowering the window size, it tells the sender about that fact. The sender may or may not take action in that case. Most certainly it would be clever to send less data at once. However, you'll often see no reaction at all in real world scenarios. It depends on the OS and applications in use.

The reason for an oscillating window size are many fold. Think about a system that does not only receive data and store then somewhere (maybe with RAM caching), but also need to process the data as soon as they are received (like doing calculations, printing data if it is a printer, etc.). In that case the receiver might get more data than it can process in a defined time slot and then it would lower the receive window, to let the sender know.

So, the oscillating window size alone does not necessarily have an effect on the throughput. If the window size does not drop to far (let's say 10-20%), the sender can still send data fast enough in most cases. It will have an effect on links with a very high RTT, where the sender could potentially fill the whole pipe with one receive window. If in that case the receive window gets smaller, it will have an effect on throughput.

Anyway: Throughput problems are more often related to packet loss than to windows size updates, unless the receive window drops to far (near 0 or to 0). In that case it will obviously have an effect on throughput.

So, to figure out what's going on in your TCP connection you need to look at several things

• RTT (see TCP RTT graph)
• Window updates (Window scaling graph + Expert messages: Zero Window, etc.)
• Packet loss (Expert messages: DUP ACK, Retransmission, etc.)

Those things, together, will affect your throughput.

Regards
Kurt