Hello Gang,
I'm fiddling with TCP windows and I'm seeing that when
I shrink the window to below 1448 (the payload size of an ethernet
frame after the appropriate headers) the behavior gets weird.
Using tcpdump, I observed that when the window shrunk below
1448, to lets say 1400 bytes, I'd get 1 packet sending 1400 bytes,
and then the next ethernet packet sending 48 bytes. This would
alternate until the transmission was done. As a result, I'd fall from
an average of 970k/sec doing a web transfer to around 4k/sec.
Here is a snippet of a tcpdump:
13:40:14.004319 ford.http > oid.1097: . 46337:47737(1400) ack 16 win 32120
<nop,nop,timestamp 17524577 1756523> (DF)
13:40:14.005740 oid.1097 > ford.http: . ack 47737 win 1400 <nop,nop,timestamp 1756554
17524577> (DF)
13:40:14.005794 ford.http > oid.1097: . 47737:47785(48) ack 16 win 32120
<nop,nop,timestamp 17524577 1756554> (DF)
13:40:14.111628 oid.1097 > ford.http: . ack 47785 win 1400 <nop,nop,timestamp 1756565
17524577> (DF)
13:40:14.554308 ford.http > oid.1097: . 47785:49185(1400) ack 16 win 32120
<nop,nop,timestamp 17524632 1756565> (DF)
13:40:14.555735 oid.1097 > ford.http: . ack 49185 win 1400 <nop,nop,timestamp 1756609
17524632> (DF)
13:40:14.555784 ford.http > oid.1097: P 49185:49233(48) ack 16 win 32120
<nop,nop,timestamp 17524632 1756609> (DF)
13:40:14.571516 oid.1097 > ford.http: . ack 49233 win 1400 <nop,nop,timestamp 1756611
17524632> (DF)
13:40:14.864311 ford.http > oid.1097: . 49233:50633(1400) ack 16 win 32120
<nop,nop,timestamp 17524663 1756611> (DF)
13:40:14.865737 oid.1097 > ford.http: . ack 50633 win 1400 <nop,nop,timestamp 1756640
17524663> (DF)
13:40:14.865783 ford.http > oid.1097: . 50633:50681(48) ack 16 win 32120
<nop,nop,timestamp 17524663 1756640> (DF)
13:40:14.971423 oid.1097 > ford.http: . ack 50681 win 1400 <nop,nop,timestamp 1756651
17524663> (DF)
Here is a snippet of thr same file being transferred with a 1500 byte
TCP window:
14:22:20.180318 ford.http > oid.1105: . 3621449:3622897(1448) ack 16 win 32120
<nop,nop,timestamp 17777172 2009208> (DF)
14:22:20.181775 oid.1105 > ford.http: . ack 3622897 win 1500 <nop,nop,timestamp
2009208 17777172> (DF)
14:22:20.181819 ford.http > oid.1105: . 3622897:3624345(1448) ack 16 win 32120
<nop,nop,timestamp 17777172 2009208> (DF)
14:22:20.183278 oid.1105 > ford.http: . ack 3624345 win 1500 <nop,nop,timestamp
2009209 17777172> (DF)
14:22:20.183323 ford.http > oid.1105: . 3624345:3625793(1448) ack 16 win 32120
<nop,nop,timestamp 17777172 2009209> (DF)
14:22:20.184780 oid.1105 > ford.http: . ack 3625793 win 1500 <nop,nop,timestamp
2009209 17777172> (DF)
14:22:20.184824 ford.http > oid.1105: . 3625793:3627241(1448) ack 16 win 32120
<nop,nop,timestamp 17777172 2009209> (DF)
14:22:20.186280 oid.1105 > ford.http: . ack 3627241 win 1500 <nop,nop,timestamp
2009209 17777172> (DF)
14:22:20.186324 ford.http > oid.1105: . 3627241:3628689(1448) ack 16 win 32120
<nop,nop,timestamp 17777172 2009209> (DF)
14:22:20.187785 oid.1105 > ford.http: . ack 3628689 win 1500 <nop,nop,timestamp
2009209 17777172> (DF)
And a snippet of a 724 byte window (1448/2) -- this one is esp. weird
because I'm getting two ack's for every send.
14:06:18.584305 ford.http > oid.1103: . 117289:118013(724) ack 16 win 32120
<nop,nop,timestamp 17681035 1913029> (DF)
14:06:18.585156 oid.1103 > ford.http: . ack 118013 win 724 <nop,nop,timestamp 1913049
17681035> (DF)
14:06:18.585199 ford.http > oid.1103: . 118013:118737(724) ack 16 win 32120
<nop,nop,timestamp 17681035 1913049> (DF)
14:06:18.585228 oid.1103 > ford.http: . ack 118013 win 724 <nop,nop,timestamp 1913049
17681035> (DF)
14:06:18.586053 oid.1103 > ford.http: . ack 118737 win 724 <nop,nop,timestamp 1913049
17681035> (DF)
14:06:18.586125 oid.1103 > ford.http: . ack 118737 win 724 <nop,nop,timestamp 1913049
17681035> (DF)
14:06:18.784308 ford.http > oid.1103: . 118737:119461(724) ack 16 win 32120
<nop,nop,timestamp 17681055 1913049> (DF)
14:06:18.785157 oid.1103 > ford.http: . ack 119461 win 724 <nop,nop,timestamp 1913069
17681055> (DF)
14:06:18.785203 ford.http > oid.1103: . 119461:120185(724) ack 16 win 32120
<nop,nop,timestamp 17681055 1913069> (DF)
14:06:18.785232 oid.1103 > ford.http: . ack 119461 win 724 <nop,nop,timestamp 1913069
17681055> (DF)
14:06:18.786051 oid.1103 > ford.http: . ack 120185 win 724 <nop,nop,timestamp 1913069
17681055> (DF)
14:06:18.786125 oid.1103 > ford.http: . ack 120185 win 724 <nop,nop,timestamp 1913069
17681055> (DF)
Any tips for understanding why this happens would be greatly appreciated. =)
-Steve
--
______________________________________________________________________________
Steve Shah ([EMAIL PROTECTED]) | SysAdmin/Coder/Gabbernaut/DJ/Writer/Minister
http://www.cs.ucr.edu/~sshah | We're not dropping out, we're infiltrating.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Beating code into submission, one operating system at a time...
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]
