|
After doing a capture from the source to the destination address. I keep seeing an TCP {Ack} being sent and an a{PSH}, but no {ACK}. After a minute or so I get the {TCP ZEROWINDOW PROBE}, which is causing the backup server to hang since theres no data actually being sent correctly. Not sure what would cause the {TCP ZEROWINDOW PROBE}. I have read up on it and I believe it has something to do with the destination IP Address Buffer being filled up to quickly.
This question is marked "community wiki".
|
|
Correct. TCP window probe means that the receiver has reduced his receive buffer (a.k.a. window) to zero, basically telling the sender to stop sending - usually for performance reasons. If the receiver does not recover and send an so called "Window Update" with a buffer size greater than zero (meaning, the sender is allowed to continue) the sender will become "impatient" at some point and "check" if the receiver is able to receive more data. That "check" is the Zero Window Probe you observed. If you run into packets diagnosed as Zero Window Probe you can tell that your receiving node is not able to process incoming data fast enough. That is the typical performance problem that everybody blames the network for, while it is in fact a software/hardware problem on the receiving node. what would cause it to happen on multiple printers (different brands) on the same network?
(12 Oct '12, 11:42)
aPauling
I have seen printers use zero window signaling to slow down/stop transmission from print servers/workstations while they're busy waking up and spinning up their internal mechanical parts. When ready, the zero window is pulled up to signal that the sender may continue. It's like a "wait a second, need to get running first... okay, send".
(12 Oct '12, 14:07)
Jasper ♦
|
