This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

FTP performance issue

0

Hi! (Sorry its about Window Size thing and many answers available but please answer for my explanation. Thanks)

I am working on issues that my FTP takes longer time to download and upload files. I did a capture on FTP server. The client is downloading a file in this scenario. Server OS = win 2003 No high delta time. I can see line lines [TCP Window full]

Client to server: 14119 > ftp-data [ACK] Seq=1 Ack=196609 Win=64860 Len=0 I have window size of 64860 and i am sending 0 packet

Server to Client 14119 FTP-DATA [TCP Window Full] FTP Data: 4140 bytes

Server is telling client that I am sending 4140bytes and my buffer size is full ???

Any help to check where the problem is so that we can reduce the transfer time.

Thanks

asked 10 Apr '14, 07:16

capricorn800's gravatar image

capricorn800
16224
accept rate: 0%


One Answer:

0

I would start with a tcp.analysis.flags filter and look at the Statistics -> Flow Graph. If you see lots of window_full conditions then it's the client's tcp receive buffer that is too small to fill the pipe. See Bandwidth Delay Product and RFC1323: http://lmgtfy.com/?q=rfc1323+bdp

Without seeing a portion of the capture it is hard to help through this forum. Any chance you could put a snippet to http://cloudshark.org ? You can use editcap -s 100 infile outfile to chop the full packets to just the header information.

answered 10 Apr '14, 10:36

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Hi!

Thanks for you reply.

As I am filtering on specific source IP i use the following filter: ip.addr==Client IP address && tcp.analysis.window_full and just found 27 line out of 100+ lines. If server sending information to client with Tcp window full then its server window which is full??

I cant post the capture due to restriction.

can you explain this:

Server to Client FTP-DATA [TCP Window Full] FTP Data: 4140 bytes

Server to Client FTP-DATA [TCP Window Full] FTP Data: 2760 bytes

Thanks,

(11 Apr '14, 03:04) capricorn800

"just" 27 out of 100+ is more than 20% ! I tink you need to enable WindowScaling on your client in order to get a better throughput. it your client is running Windows as the offered windowsize suggests then you need to set Tcp1323Opts to "1" (or "3" if you also want TIMESTAMP option)

The "FTP Data: 4140/2760 bytes" indicate that LargeSendOffload or TCP Segmentation Offload is enabled on the server's interface and the MSS is 1380 bytes

(11 Apr '14, 04:45) mrEEde

(Answer converted to a comment in keeping with the way ask.wireshark.org works; Please see the FAQ).

But the problem is on Server side (ftp server). Its not just one client its more client that are seeing sluggish effect while downloading and uploading files. Can i check something more to troubleshoot the slowness?

(11 Apr '14, 06:46) capricorn800

I think you are misinterpreting the INFO line. It is not the server telling the client that the Window is full, it is wireshark that detected that the server has sent as many bytes as the client's windowsize offered and now needs to wait until the client opens its window again - which might take a while - depending on the RTT of the connection. With the information you offered that's all I can advice - sorry.

(11 Apr '14, 09:19) mrEEde

Thanks mrEEde. Can i upload excel format file as i need to change the info?

(14 Apr '14, 02:46) capricorn800