Secondly shouldn't both the server and the client be fairly close to one another? asked 28 Oct '14, 06:49  EdJ edited 28 Oct '14, 08:14 |
I would like to know what the Y axis represents when I build an I/0 graph based upon TCP window size. When I graph the window size for the Y axis the unit I select is advance. Then for Graph 1 the filter I use filter:ip.src==ServerIP Calc:AVG()tcp.window_size then for graph 2 filter:ip.src==ClientIP Calc:AVG()tcp.window_size.
2 Answers:
No, it is not necessary for the server and client window sizes to be close to each other. The TCP Window Size is the amount of space currently available in the receive buffer. The receive buffer sizes can differ quite a bit, depending on what the two systems do. For example, if the server is a web server, then data will flow primarily from the server to the client. The server only needs a receive buffer large enough for GET requests from the client, but the client needs a receive buffer large enough for the actual web pages that will be downloaded. On the other hand, if the server is an FTP server, then it needs a much larger receive buffer in order to handle uploads. As long as the window sizes never get so small that communication pauses (usually less than one Maximum Segment Size), then the windows are large enough. Maybe it would make more sense to graph the minimum window size, rather than the average. answered 28 Oct '14, 10:36  Jim Aragon |
That's the average (AVG) value of the field you are reporting on, in your example tcp.window_size. Regards answered 28 Oct '14, 08:49  Kurt Knochner ♦ |
