Ethereal-users: RE: [Ethereal-users] Can you help me diagnose a performance problem?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Jim Hendrick" <jrhendri@xxxxxxxxxxxx>
Date: Thu, 29 Jul 2004 01:36:11 -0400
Title: Message
Hmmm. Not sure why the window sizes are different or the ACK policies differ.
 
Does anyone know how XP handles selective ACK? It seems like the one that is ACKing multiple packets is faster (although this is probably not the reason for the difference).
 
Another basic Q. Is the physical layer identical for both (cables, network drops, patch panels if any, switches, etc. etc.)
 
Can you try a file transfer within your own network? Perhaps even between a "fast" and "slow" machine (in each direction) or from both to (and from) a 3rd machine.
 
This may not point out anything, but it will be a more controlled test.
 
It may be as simple as a physical or a software (card / driver) issue, but what the *reason* behind it is not obvious.
 
 
-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Steve
Sent: Wednesday, July 28, 2004 10:58 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Can you help me diagnose a performance problem?

Hi, first time on the list and not exactly a network specialist, so bear with me!

 

I’ve been struggling with a performance problem where Internet downloads from one machine tend to be about 20% slower than those from other machines on the network (all Win XP Pro). All settings I can think of are identical, and the “slow” machine is about the fastest on the network in all other respects. Ethereal captures do show up some interesting differences. Traffic from a “slow” machine looks like this (hope it formats OK):


  15818 23.220614   144.135.23.54         192.168.0.5           TCP      4000 > 3091 [ACK] Seq=11378574 Ack=0 Win=7086 Len=1446

  15819 23.220806   192.168.0.5           144.135.23.54         TCP      3091 > 4000 [ACK] Seq=0 Ack=11380020 Win=64000 Len=0

  15820 23.229900   144.135.23.54         192.168.0.5           TCP      4000 > 3091 [ACK] Seq=11380020 Ack=0 Win=7086 Len=1446

  15821 23.230082   192.168.0.5           144.135.23.54         TCP      3091 > 4000 [ACK] Seq=0 Ack=11381466 Win=64000 Len=0

Each ACK acknowledges the segment before it, and has a time to ACK the segment of around .00018 seconds.

Traffic from a "fast" machine looks like this:

   4095 5.885410    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3865158 Ack=0 Win=6810 Len=1446

   4096 5.886590    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3866604 Ack=0 Win=6810 Len=1446

   4097 5.886617    192.168.0.4           144.135.23.54         TCP      1101 > 4000 [ACK] Seq=0 Ack=3868050 Win=64000 Len=0

   4098 5.887665    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3868050 Ack=0 Win=6810 Len=1446

   4099 5.889292    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3869496 Ack=0 Win=6810 Len=1446

   4100 5.889346    192.168.0.4           144.135.23.54         TCP      1101 > 4000 [ACK] Seq=0 Ack=3870942 Win=64000 Len=0


Each ACK again acknowledges the segment before it, but only every second segment gets ACK'd. Also the time to send the ACK is now .00003 (much
quicker). I also don't know why the sender's Win size is different in the 2 cases.

 

Can anyone point me in the right direction here? Thanks.

 

Steve