This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Window Size Full

0

Hello,

I am trying to undestand TCP receive window. I am getting a lot of tcp window full messages at client side but not tcp window zero messages when I send data from client to the server using iperf. The problem is the tcp receive window of server shows 64240 bytes in the previous frame. Can anyone help me figure out how does the receive window size drastically decrease to zero and also to measure the rate at which the receiver buffer processes the data I have added captures below:

link:Capturefile

PS: I HAVE DISABLED WINDOW SCALING

asked 26 May '16, 10:10

gravatar's gravatar image

gravatar
6112
accept rate: 0%


2 Answers:

0

The receive window value is only relevant in relation to what has been acked. So while your server window is 64k you have as many bytes in flight, meaning that the window is used by not-acknowleged data.

Simple example:

  1. server announces 64k window size
  2. client sends 64k
  3. server acknowledges packets worth 2k, and announces 64k window in the same packet

this means that the window is only 2k, because 62k are still unacknowledged and are part of the 64k window. client sends 2k, and again the "window is full".

Also, "Window Full" is not the same as "Zero Window". Window Full means "bytes-in-flight equals advertised window size of receiver". Check the TCP layer for the bytes-in-flight value to see what I mean.

answered 26 May '16, 14:12

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 26 May '16, 14:13

Thank you.

(27 May '16, 18:24) gravatar

0

What I see in this capture is that the client is sending so much data that the number of bytes in flight (the unacknowledged bytes) reaches to reported window size (the receive window full) (frame 233). That's were the the client stops, waits until an ACK is received (frame 234), showing that the window has room again, which is immediately filled until it's full again (frame 236). Etc, etc.

answered 26 May '16, 14:22

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thank you.

(27 May '16, 18:24) gravatar