Hello all,
Many clients download data from a server farm. Occasionally the download is slow. This server farm is located behind an F5 loadbalancer. The F5 does terminate the https connection from the client. It then starts its own https session to the real server.
2 traces are attached one is slow and the other is fast. My goal is to find out which device is the root cause of this issue. Trace is made via tcpdump at LB
https://drive.google.com/open?id=1Zrv87fo6y0FHpDngEsl33Q4AoKfCFpmr
https://drive.google.com/open?id=1buzm1GJDvP1X0xWEFqTHZIZxQSUHXgBk
I could see that the server does not send data to LB when the LB advertises a window size of an MSS or lower. I could measure around 6 seconds in the slow trace caused due to this behavior. So can I then conclude that this is the Server issue?
Why does the server not send data when the window size is <= 1 MSS? is it due to some congestion avoidance algorithm implemented at the server? Is there any known OS which behaves in this manner?
Please assist. Regards
