ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] TCP Window Sizes

From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 9 Sep 2008 22:46:11 +0200
On Tue, Sep 09, 2008 at 04:00:34PM -0400, Aaron Allen wrote:
> I am seeing >10mbit with larger window sizes consistently on 
> different servers.  The rtt should be lower on the second trace 
> just because it is hitting a different amazon datacenter (and 
> thus the higher throughput).

When you say "on other servers", do you mean "from other servers
towards the amazon server" or "from this Win2008 server towards
other servers"?

I do still see that there are two packets sent every time, adding
up to 2048 bytes. Are you sure TCP segmenting offloading is off?
Looks to me like the NIC is still splitting up the 2K packets
it gets from the application. Your server does not seem to
honor the high windowsize that is offered by the amazon server.
If it did, it should blast out many packets pefore needing
an ack. And in the 2nd trace that you sent, it only sends out
8K before needing an ack.

Looks like somehow you're hitting a buffer size locally.

I'm still interested in a trace made on the server and one on the
span port at the same time (with tcp segment offloading enabled).
For reference it would be nice if you could do the same for one
"other server" on which you see good throughput. So in total that
would result in 4 tracefiles. Please use ip-addresses instead of
names so that the traces can be compared in regard to rtt times.

Cheers,
    Sake