LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 01-31-2010, 10:27 PM   #1
mohitanchlia
Member
 
Registered: Aug 2008
Posts: 60

Rep: Reputation: 15
TCP advertised window size


In trace file of tpcdump I am seeing Zero window size. I have receive buffer set like this:

net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

But when I look at the advertized window size it's only 1K? Why is it not set to more than that? I should see it 16M somewhere it doesn't start with it neither does it scale that much. tcp_window_scaling is also set to 1
 
Old 02-01-2010, 08:45 PM   #2
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
If your TCP window is closing, your application is not reading data quickly enough/often enough. This can also happen some times when a firewall is removing the Window Scaling flag. When WS is in effect, your window is a multiple of what you advertise, but if a firewall silently stripped out the WS multiplier, the other side of the TCP connection will see a tiny window and it will close quickly.

If you take the tcpdump from your machine it should show the correct window for you, but possibly a too-small window for the other side. Same thing for a tcpdump from the other side--they'll see their own window OK, but yours might be too small (depending on where the firewall is that's stripping the WS multiplier. Note that this isn't a frequent problem, just a possible one.
 
Old 02-02-2010, 09:34 AM   #3
mohitanchlia
Member
 
Registered: Aug 2008
Posts: 60

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by chort View Post
If your TCP window is closing, your application is not reading data quickly enough/often enough. This can also happen some times when a firewall is removing the Window Scaling flag. When WS is in effect, your window is a multiple of what you advertise, but if a firewall silently stripped out the WS multiplier, the other side of the TCP connection will see a tiny window and it will close quickly.

If you take the tcpdump from your machine it should show the correct window for you, but possibly a too-small window for the other side. Same thing for a tcpdump from the other side--they'll see their own window OK, but yours might be too small (depending on where the firewall is that's stripping the WS multiplier. Note that this isn't a frequent problem, just a possible one.
How do I know if firewall is removing the WS flag?

Also I didn't understans why window is multiple and what it means? Does it mean if I am advertising 16M in receive buffers it really is 32M?

What's the easiest way to track down this problem?

Thanks for your help and suggestions
 
Old 02-03-2010, 03:59 PM   #4
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
This article explains Window Scaling and the effects thereof. BTW I incorrectly said the WS value is a multiplier. That's not quite right, it's a bit-shift from which a multiplier is derived.
 
Old 02-04-2010, 10:44 AM   #5
mohitanchlia
Member
 
Registered: Aug 2008
Posts: 60

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by chort View Post
This article explains Window Scaling and the effects thereof. BTW I incorrectly said the WS value is a multiplier. That's not quite right, it's a bit-shift from which a multiplier is derived.
Thanks it's a great article. How can I track down such that I can specifically say that's it's router or firewall problem? Can I see something in tcpdump? If yes then what do I need to look at?

I am also seeing the following in netstat that keeps increasing. Do you think it could be related to that?

92664734 packets collapsed in receive queue due to low socket buffer

Thanks for your great response
 
Old 02-04-2010, 11:29 AM   #6
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
It sounds to me like your application is not reading from the buffer often enough, or pulling enough data from the buffer at one time. Have you tried increasing the size of your reads or the frequency of polling?

You can use tcpdump to view the SYN packets in a connection. There should be a WS= TCP option if Window Scaling is being used. Both sides need to support it for it to be used.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
tcp send window size discrepency Viken Kondakji Linux - Networking 0 10-24-2007 01:20 PM
Confusion regarding the TCP window size bzlaskar Linux - Networking 3 07-06-2007 02:52 PM
increasing TCP window size linux_mando Linux - Networking 2 02-27-2007 09:56 AM
Setting tcp receive window size cwwilson721 Linux - Networking 2 01-21-2007 06:43 AM
tcp/ip window size h/w Linux - Networking 2 12-04-2003 10:08 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 12:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration