ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Regarding server's acknowledgement to httpRequest sent

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Tue, 19 Aug 2008 20:54:25 -0400
naveen duniwal wrote:
Hi,

I am working on a project for improving performance, for this I am using wireshare to observe time taken by response to come back for a particular request.

for some request's , I get server acknowledgment to that request and then later i get response for that request ( say it is case 1) , but for other request ( different request url ) I get server's acknowledgment and response in the same frame ( say it is case 2).

# Case 1
I am copying wireshark frames in this case.

Request sent
"788","83.609659","192.168.130.73","192.168.133.101","HTTP","POST /FXTrader/Workflow.do?requestURI=dropdownCcy&event=dropdownCcySelected&workflowMessage.ccyPair=USDJPY&workflowMessage.customField=DirectFXTrader_DirectFXTrader_Tradi ngTab0_DealingRateCcPair5&workflowMessage.activetab=DirectFXTrader_TradingTab0&workflowMessage.index=5 &workflowMessage.resetCFs=false&workflowMessage.tenor=SPOT&workflowMessage.validate=tenor&workflowMessage.ccyCustomFieldsList= HTTP/1.1 (application/x-www-form-urlencoded)"

Server's acknowledgement to my request
"789","83.709141","192.168.133.101","192.168.130.73","TCP","http > pptp [ACK] Seq=86180 Ack=42783 Win=32767 Len=0"
    This is acknowledgement to the segment in frame in :788
Response to my request "794","84.024469","192.168.133.101","192.168.130.73","HTTP/XML","HTTP/1.1 200 OK" <qtPanel><tenors val='SPOT~IMM1~IMM2~1W~2W~1M~2M'/><tenor val='SPOT'/> <isBD val='false'/></qtPanel>


# Case 2

Request Sent
"265","20.797080","192.168.130.73","192.168.133.101","HTTP","GET /jmsproxy/?cmd=P&uid=524504&c=20&wMs=5000&p=1&aIL=&rL=125&mI=125&mpt=250&lmc=20&QTpt=16&IRpt=0&sts=200&ld=18:216:230&ts=1219051797502&nTQ=11&nTI=3 HTTP/1.1"

This frame shows that it is Server's acknowledgement to my request as well as it contains response, so i am assuming that it is response. "266","20.899251","192.168.133.101","192.168.130.73","HTTP","HTTP/1.1 200 OK (text/html)"
    This is acknowledgement to the segment in frame in :265

<script>parent.p([["TQ",1,0,"TQAUDUSD",{"V":"AUD/USD~TRD2cbe1d01ed11bd5263b743ea9d7~USD~4~2~0.0~0.0~0.0~0.0~0.0~0.0~0~20080820~10000~1.0$T1 #0.6875#0.6850#2.5E7#3.0E7#A#0#0#$T2#0.6874#0.6851#5.0E7#6.0E7#A#0#0#$T3#0.6873#0.6852#7.5E7#9.0E7#A

So my doubt is why there is a difference between these two cases ? Actually my concern is that in case#1 , I am getting response after around 400ms but in case#2 that is only 100 ms.I want to modify my case#1 to reduce this delay.


I can think of following possible differences:
    1.    The size of the request is higher in case#1 as compared to case#2.
    2.    response is http/xml in  cases#1
    3.    content-type is application/x-www-form-urlencoded in Case#1.

I will appreciate any help or suggestiong in this regard.

Thanks in advance.

Regards
Naveen


Naveen,
In general, it's easier if you email the pcap file (after proper munging of data or editcap'ing it to headers only). You are comparing apples and oranges. In case #1, it looks like the ACK (frame #2) is being sent as a delayed acknowledgment. The 100ms delta is common for (Unix) delayed ack. Windows tends to default to 200ms. So the server gets the request, the app is munching on the data and and 100ms later, the server sends just an ACK after 100ms timer goes off. After 300ms of server processing delay, the data comes back. There is another possible explanation but I can't tell w/o knowing the round trip delay between the two servers.


In case #2, the delayed ack did it's job. After waiting for about 100ms, the server sent some data and the ack got piggybacked on the data packet.

The two requests are different so you need to take that into consideration.

However, in trading applications that use TCP, it's EXTREMELY important to pay attention to the penalty you can pay for NAGLE and delay-ack deadlock.

While you cannot force TCP to do anything, you can stack the odds in your favor. It's entirely possible that the application sent the data to the tcp stack, and TCP - obeying Nagle - held on to the data in case more data was forthcoming from the application. In fact, the application timestamp logs may show that it "sent" the data 100 to 200 ms sooner than what you see on the network. This can happen as the TCP stack hangs on to the data - obeying Nagle delay - in case he can load up the packet.

Since you don't have access to FXtrader's socket options, you may have to tweak the server's tcp stack and hope that the application won't override the setting at the socket level. In general, you can ndd the server to set the no_delay option to turn off Nagle. There are a lot of pitfalls, so careful testing monitoring is required. But that discussion is beyond the scope of this list.

Google for "nagle delayed ack" and you'll get a lot of hits.



--

Thanks,
Hansang