Wireshark · Ethereal-users: [Ethereal-users] increasing tcp window size

["keithwong" <keithwong@xxxxxxxxxxxxxxxx>]

Hi everyone,

I'm working on a web application that requires users to upload files onto a web server over ssl. The size of these files range from 50K to 2.5MB. In our development environments we have no problem uploading the largest file. However when this application is run over the internet we get unusual problems for large files. Sometimes the file successfully uploads however most of the time the upload fails and responds with "page not found 400 error". If however we upload the file from our clients intranet we have no problem uploading the file.

 

The only conclusion I can come to is for some reason the https connection drops out. I've taken a dump of the network activity from a user's machine at the time when the connection seems to die. This was taken on a Windows 2000 machine using IE 5.5. The server machine also runs on Windows 2000 and uses IIS 5.

This is a dump of the trace from Ethereal...

1358 101.779797      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747331447 Win=3957 Len=0
1359 101.779983      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747333820 Win=1584 Len=0
1360 101.780226 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy    
HTTP Continuation
1361 101.846065      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747335280 Win=7364 Len=0
1362 101.846128 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy    
HTTP Continuation
1363 101.846167 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy    
HTTP Continuation
1364 101.846192 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy    
HTTP Continuation
1365 101.846213 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy    
HTTP Continuation
1366 101.850486      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747338200 Win=4444 Len=0
1367 101.850618      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=2555 Len=0
1368 102.035648      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=9795 Len=0
1369 102.231611      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=17035 Len=0
1370 102.426010      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=24275 Len=0
1371 102.511702      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=28619 Len=0
1372 102.595514      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=32963 Len=0
1373 102.675749      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=37307 Len=0
1374 102.756940      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=41651 Len=0
1375 102.981833      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=51787 Len=0
1376 103.191974      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=59027 Len=0
1377 103.285043      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=63371 Len=0
1378 106.678260      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
HTTP Continuation
1379 106.678429      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
TCP 8080 > 1359 [FIN, ACK] Seq=1877836940 Ack=747340089 Win=65535
Len=0
1380 106.678469 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy    
TCP 1359 > 8080 [ACK] Seq=747340089 Ack=1877836941 Win=17058 Len=0
1381 106.678906 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy    
TCP 1359 > 8080 [RST] Seq=747340089 Ack=1877836663 Win=0 Len=0

It seems the proxy sends back the same ACK message for a while but continually increases the window size. It eventually then sends a FIN, ACK message to close the connection and IE seems to spit out a RST message.

I'm not exactly sure what this increasing window size means, but there must some network settings I can try to configure on the server to help alleviate this problem.

Thanks in advance.

Cheers,
Keith