What would be some of the reasons that I am seeing TCP Window Full flag in Wireshark? I am performing an upload to my server, and the flag is seen on the packets that the user is sending to the server. asked 05 Jul '12, 16:57  shpakster edited 07 Jul '12, 22:20  helloworld |
2 Answers:
It is not really a flag, it's a diagnosis made by Wireshark's TCP expert. It means that Wireshark has seen as many bytes being sent as the receiver signaled to be able to receive before the sender needs to stop and wait for an acknowledgement. Depending on how long the acknowledge takes a Window Full situation can slow down data transfers more or less drastically because the sender just can't continue until the ACK comes in. The usual solution to this is to increase the servers receive window size (if possible at all) to allow more data to travel towards the receiver at the same time. answered 05 Jul '12, 17:50  Jasper ♦♦ |
As Jasper said, the usual solution is to increase the receive window size. The fact that window scaling is in use does not mean that the window size is as large as possible. For example, I'm looking at a trace file right now where both systems advertise a window scale factor of 8 (multiply by 256), but then they only use a window size of value of 256. A window size value of 256 multiplied by the window scaling factor multiplier of 256 gives an actual window size of 65,536 bytes. We could have a window size that large without window scaling. So check the actual receive window size. Also, you might check for a lot of lost packets / retransmissions from the server to the client. It's possible that Wireshark and the client think the receiver's window is full because ACKs are getting lost on the way back. answered 06 Jul '12, 15:51  Jim Aragon |
The server is a Windows 2008 server and window scaling is enabled. Is there anything else that can be done?
why would this happen? The receiver tells the sender the n-bytes that it can receive, then the sender should just send the n-bytes and no more. I don't understand under what situation would the sender send more data than the window advertised by the receiver. Please help!
The sender NEVER it allowed to send more data than allowed by the reciever specified through recieve window.