hello, TCP as a streaming protocol.Question is when the receiver is acknowledging an packet will it still wait for the application to read the data from the buffer and only than remove it from the buffer? Thank you asked 12 Mar '16, 15:16  adasko |
One Answer:
Of course - acknowledging packets only means that it has been received and put into the receive window buffer. As soon as the application picks up the packet (well, the "segment", to be more exact) the free receive window size grows again. That's why you sometimes see the window size drop - that's when the packets were acknowledged, but the application is slow in pulling segments from the window buffer. answered 13 Mar '16, 00:02  Jasper ♦♦ |
How could I troubleshoot whether it's the network or host / application that is slowing down the performance? Could I use Wirehsark for this ?
Sure. It depends on your capture location and skill of analyzing TCP behavior. If you don't see massive packet loss or delays caused by the network (for which you'd need to capture both at client and server and compare the packets) it's usually the application.
Could it be also the host itself not just the application ?
Yes, but that's still harder to prove usually. You'd look at slow TCP based reaction times (to see that the stack is under stress) and other things. I'd recommend checking the host stats with onboard performance monitoring.
so an indication that the problem is with the receiving app would be a small window size advertised to the sender even though packets are getting ACK'ed ?