0

In my LAN, I have a router that runs a Samba server and my PC connects to the router.

I wiresharked during uploading a file from my PC to the samba server.

Below is a shortcut of the wireshark result,

enter image description here

As can be seen, after server's reply in frame 7560, my PC sends several packets which are all full sized(frame with 1514 bytes).

enter image description here

But in frame 7560, the advertised window size is 94 bytes.

And the above situation happens throughout the results.

So, what I cannot understand is how can my PC sends almost 30000+ bytes while the last packets from the server only advertise a 94 bytes window.

sliter
  • 225
  • 1
  • 3
  • 6

2 Answers2

1

Window size is affected by network buffer size, the default setting in Linux 2.6 should be fine, in case the network buffer is too small, use following recommded value for Gigabit Ethernet

sysctl -w net.ipv4.tcp_rmem="40960       1048560 4194304"
sysctl -w net.ipv4.tcp_wmem="40960       196608  4194304"
sysctl -w net.core.rmem_max=4194304
sysctl -w net.core.wmem_max=4194304

more details http://honglus.blogspot.com/2010/01/double-network-throughput-by-tuning.htm

You can use iperf to detect window size, if it reports fine for server's local NIC, then it might be issue with the router or app

honglus
  • 149
  • 2
  • While it is nice to know how to detect or change the window size, the questioner originally aimed at to *why* the window size advertised in frame 7560 has been exceeded by several magnitudes by the sending party. – the-wabbit Jan 10 '12 at 23:38
1

I would think this is TCP Window Scaling at work - it probably has been negotiated at connection setup and is not taken into account by Wireshark. So the advertised window size is not 94 Bytes but (2^ x) * 94 where x is the scaling factor.

the-wabbit
  • 40,737
  • 13
  • 111
  • 174