ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] TCP Window Sizes

From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 9 Sep 2008 20:47:55 +0200
On Tue, Sep 09, 2008 at 07:31:48PM +0200, Sake Blok wrote:
> On Tue, Sep 09, 2008 at 12:48:59PM -0400, Aaron Allen wrote:
> 
> From the pattern of your ack's, it looks like your server has the
> nagle algorythm enabled and the Amazon server has delayed acking 
> enabled with a wait time of 100ms. What I think happens is the 
> following, but that should be checked with a trace on a spanport
> as tracing on your server will be done *before* the packet is
> segmented by the NIC.

Hmmm... I looked at the trace again and I'm not sure anymore if
it is indeed the nagle-delayed_ack problem. Could you make a 
trace like the one you sent, both on the server as on a laptop
attached to a span-port on the switch (with your server port
spanned to it)? I'd like to see the role of the TCP
segmentation offloading on the delays that are visible in your
trace (which seem to be occurring after every 7-8k of data and 
slowly increase in delaytime).

Cheers,
    Sake