The behaviour of clients and servers has an impact on the performance of the application delivery. Tracking key indicators at the TCP level can help to diagnose performance issues. Understanding these metrics is key to troubleshooting slowdown!
0-Windows is one of these key indicators. This article will teach you how to interpret this data whether you use Wireshark or PerformanceVision.
During a TCP session the client and server announce to each other the amount of data they can manage. This buffer size is called window size.
This window size change all the time to optimize the data flow according to the network capacities.
When a machine starts to send more and more 0-win you have to investigate if there are enough resources, CPU, RAM…
For the sake of simplicity, we will not consider here other TCP mechanisms like slow start or congestion control.
Just open a tracefile with Wireshark and take a look at a TCP Packet, you will find the TCP Window size values (flagged in red in the image hereunder); to identify the packets containing a 0 Window, you can use the following filter: "tcp.analysis.zero_window" .
When you need to identify the one machine in thousands of workstations, which suffers from slow transfers due to 0-Windows, you may want to use a solution like PerformanceVision. It computes millions of packets every second to provide statistical and historical data which points you to the right place in seconds. If you are interested in discovering how PerformanceVision can help you scale up your network troubleshooting capabilities, you should read this article.
It’s so easy to find the 0-Win machine. You go to Application>TCP Events screen:
It displays the conversations you are interested in. You can simply filter by number of 0-Window events. You can see which client or server is emitting most 0-Windows and hence slowing down the data transmission.
To learn how to troubleshoot network and application performance degradations in 4 easy steps, you can download our Performance Troubleshooting Guide: