This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Window Sizes

0

Im troubleshooting an issue where we are receiving slow transfer speeds when going to one server and not the other. i.e

  • Client A - Server A (UK) 1MBps
  • Client A - Server B (Germany) 10MBps

The RTT is the same for both i.e around 60ms.

Client A advertises his window in the SYN ACK as 40880 (i.e window size 5840 * Window Scale of 7) However for the transfer for client A I see the window size go no higher then 191488 (??) Also can the window go higher then what is announced by the receiver ?

Thanks,

asked 29 Jan '15, 00:12

bart80's gravatar image

bart80
11121316
accept rate: 0%

edited 29 Jan '15, 00:13


One Answer:

1

Are you sure your Client A has a Window of 40880 in the SYN ACK? I doubt it, and here's why:

1) while there is a scale factor of 7, it does not mean that you multiply the actual window size with 7. It means that you multiply the actual window size with 2^7, which is 128. That would be a scaled window of 747520.

2) the scaling does not apply to packets with SYN flags, because the connection setup isn't complete yet. What your SYN ACK basically says is "hey, my window size is 5840 right now. I would like to do window scaling with a scale factor of 7 for all further packets, if you know what that means". You can usually see that - as soon as both nodes tell each other that they know how window scaling works, and thus can use it - they reduce the actual window size value in the TCP header to a much smaller window and pull it up slowly while sending data.

Regarding the maximum window size you see - it's up to the stack to advertise a window that it can live with. Since the client sort of "guarantees" that it can receive and buffer that many bytes, it may have reasons for saving memory and not advertise crazy window sizes. Also, you rarely see stacks using the full maximum size for their scaled window (which is different from unscaled window sizes, which often stay very close to the maximum of 64k).

If your Client A keeps a certain scaled window maximum size it means either it doesn't have more resources to go higher (which is very uncommon), or it just thinks it doesn't need to go higher.

What you should do is find out if the window size is a problem by determining if the communication could go faster if the Client would just advertise an even bigger window. For that you could look for delays caused by full windows.

answered 29 Jan '15, 03:05

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 29 Jan '15, 03:06