This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

ack vs read app

0

hello,

TCP as a streaming protocol.Question is when the receiver is acknowledging an packet will it still wait for the application to read the data from the buffer and only than remove it from the buffer?

Thank you

asked 12 Mar '16, 15:16

adasko's gravatar image

adasko
86343842
accept rate: 0%


One Answer:

1

Of course - acknowledging packets only means that it has been received and put into the receive window buffer. As soon as the application picks up the packet (well, the "segment", to be more exact) the free receive window size grows again. That's why you sometimes see the window size drop - that's when the packets were acknowledged, but the application is slow in pulling segments from the window buffer.

answered 13 Mar '16, 00:02

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

How could I troubleshoot whether it's the network or host / application that is slowing down the performance? Could I use Wirehsark for this ?

(13 Mar '16, 01:36) adasko
1

Sure. It depends on your capture location and skill of analyzing TCP behavior. If you don't see massive packet loss or delays caused by the network (for which you'd need to capture both at client and server and compare the packets) it's usually the application.

(13 Mar '16, 01:40) Jasper ♦♦

Could it be also the host itself not just the application ?

(13 Mar '16, 04:17) adasko

Yes, but that's still harder to prove usually. You'd look at slow TCP based reaction times (to see that the stack is under stress) and other things. I'd recommend checking the host stats with onboard performance monitoring.

(13 Mar '16, 04:28) Jasper ♦♦

so an indication that the problem is with the receiving app would be a small window size advertised to the sender even though packets are getting ACK'ed ?

(13 Mar '16, 04:55) adasko