This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

SFTP Windowing

I am troubleshooting an issue were large SFTP file transfers of > 3gb never reach speeds faster than 10mbs on a 25mbs circuit (there is no other traffic at the time of transfer). I understand the concept of how TCP windowing works. In researching the SFTP protocol I understand the SFTP does some form of its own windowing and further places restraints or limits on payload size that are much smaller than that is allowed in SSH2. As I don't have a capture yet to analyze. I am looking for advise as to what to look for?

Thank you for your time.

windowing sftp

asked 11 Sep '14, 16:37

EdJ
16●6●6●10
accept rate: 0%

One Answer:

If you have a situation where maximum theoretical speed can't be achieved (well, it is always a little less than the theoretical maximum, of course, even in best case situations), you need to look for where the time is lost. There are a couple of causes for lost time (the list is probably not close to complete, but just to have a few):

The sender is not able to send the data fast enough (e.g. slow read speed on its disks)
The sender is slowed down by the receiver, e.g. low or even zero TCP window signaling
Packet loss, resulting in retransmissions which take time and reduce the throughput because the sender will throttle down to avoid further packet loss before accelerating again
The sender sends inefficient packet sizes, e.g. when TCP time stamps are enabled and the additional bytes force the payload to be split into multiple segments, one large segment and one small
delay by devices in the network path

In Wireshark, you might want to take a look at the IOGraph in the statistics menu to see if there is a pattern. Otherwise, find the packets with the largest delta times and determine why those happen.

answered 11 Sep '14, 18:34

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%