This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi

We have been troubleshooting download speed issues for a client of ours. they are using Windows Server 2003 (with Window scaling & Selective ACK turned on). & the client is either Windows XP or Windows 7.

We have been carrying out tests by running a test script that downloads a file from one of our Web Servers multiple times & we note the time taken to download the file each time.

We have also captured the traffic on the Server & the client during this testing. We can see in the captures that every so often the sending Server waits for approx 5 seconds before continuing to send data.

Can anyone explain why this would be? Also, if the Receiver announces a TCP Window Size of Zero, apparently the sender should send a very small packet to prompt the receiver to re-announce the Window size. how long does it wait before sending this packet?

Many thanks Ian

asked 01 Jul '11, 07:45

ipittam's gravatar image

ipittam
31346
accept rate: 0%


Ian,

My understanding is that when a NIC announces TCP Windows Size of Zero then the recieve buffer is full and it can no longer accept data. The sending computer then sends windows probes to see when the recieve buffer can accept more data. The recieve computer sends a tcp windows update to receive more data. You could identify more of what is happening as the buffer fills up and releases using the filter: "tcp.window_size < == 65535"

By using the Time Display of View Packets Since Last Captured Packet, you can see the time between window zero condition and the tcp window update.

You could also create an Advanced I/O graph of avg(*)tcp.len to depict the payload size. Or another graph which depicts the tcp.len and tcp.window_size to see the window zero condition and the tcp window update.

Hope this is somewhat helpful,

John

permanent link

answered 01 Jul '11, 09:10

John_Modlin's gravatar image

John_Modlin
1205
accept rate: 0%

Do the 5-second pauses correspond with Zero Window announcements from the client? If so, the server is pausing because the client can't keep up. If not, then it's something on the server. Could the server be overloaded?

Per RFC 1122, The first Zero Window Probe should be sent when the zero window condition has existed for the retransmission timeout period. The transmitting host should increase the interval between successive zero window probes exponentially. Usually, you'll see the interval between zero window probes doubling with each probe. As always, the exact details are somewhat implementation dependent.

permanent link

answered 01 Jul '11, 11:32

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×55
×43
×41

question asked: 01 Jul '11, 07:45

question was seen: 6,122 times

last updated: 01 Jul '11, 11:32

p​o​w​e​r​e​d by O​S​Q​A