This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What is the Y axis when graphing TCP window size?

0

alt textI would like to know what the Y axis represents when I build an I/0 graph based upon TCP window size. When I graph the window size for the Y axis the unit I select is advance. Then for Graph 1 the filter I use filter:ip.src==ServerIP Calc:AVG()tcp.window_size then for graph 2 filter:ip.src==ClientIP Calc:AVG()tcp.window_size.

Secondly shouldn't both the server and the client be fairly close to one another?

asked 28 Oct '14, 06:49

EdJ's gravatar image

EdJ
166610
accept rate: 0%

edited 28 Oct '14, 08:14


2 Answers:

1

No, it is not necessary for the server and client window sizes to be close to each other. The TCP Window Size is the amount of space currently available in the receive buffer. The receive buffer sizes can differ quite a bit, depending on what the two systems do.

For example, if the server is a web server, then data will flow primarily from the server to the client. The server only needs a receive buffer large enough for GET requests from the client, but the client needs a receive buffer large enough for the actual web pages that will be downloaded.

On the other hand, if the server is an FTP server, then it needs a much larger receive buffer in order to handle uploads.

As long as the window sizes never get so small that communication pauses (usually less than one Maximum Segment Size), then the windows are large enough.

Maybe it would make more sense to graph the minimum window size, rather than the average.

answered 28 Oct '14, 10:36

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

0

like to know what the Y axis represents when I build an I/0 graph based upon TCP window size.

That's the average (AVG) value of the field you are reporting on, in your example tcp.window_size.

Regards
Kurt

answered 28 Oct '14, 08:49

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%