This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Bytes in Flight confusion

0

Hi all

I am confused about my bytes in flight results.

We are running sftp transfers (source is Europe and destination is in North America) and we are only able to get 400KB/s which is very slow for the user. So I did a wireshark of the session and am looking at the bytes-in-flight value.

Based on the capture, my receiving server can handle 23168 bytes in flight at any given time (win siz 5792 with scaling of 4). From the packet, we never get more then 13032 bytes in flight at any given time.

Which, if I am understanding correctly, means we are not using the full BW and that there is packet loss somewhere forcing retransmission. Checking the steven's graph also shows a lot of retransmission. (Based on this video https://www.youtube.com/watch?v=sIxv3YO2eYw)

So I ran another test. I did sftp transfer from a laptop in North America to the server in North America. The throughput we get is about 10MB/s. Max bytes-in-flight possible is 23600 and the max un-ack bytes in flight from the trace is 13000. This is not what I expected. I thought, that given my higher throughput, I should be constantly hitting the max possible bytes-in-flight of 23600.

So now I am confused. Did I misunderstand anything?

asked 26 Apr '16, 12:53

jzoudavy's gravatar image

jzoudavy
6112
accept rate: 0%


One Answer:

0

You need to keep a close eye on the Round Trip Time. The shorter the distance the faster you get your ACKs back, and fast ACKs mean less bytes in flight. So the closer you get the smaller your bytes in flight get, and the less window size you need for full performance.

Did you calculate the optimum window size for both connections? I recommend this Youtube Video to learn why it matters.

answered 26 Apr '16, 13:00

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%