Wireshark · Ethereal-users: RE: [Ethereal-users] Can you help me diagnose a performance problem?

["Jim Hendrick" <jrhendri@xxxxxxxxxxxx>]

Title: Message

Do you see the same ACK behavior for outbound from the slow PC? I am beginning to suspect that it has to do with that (since you seem to have eliminated all the other likely areas).

 

Not sure why the "sender" would do this, but it almost looks like there is a delay when the sender waits for the ACKs, and your "fast" PC is issuing an ACK for each packet so the transfer goes more quickly.

 

Not a great technical analysis admittedly.

 

Have you looked closely at the inter-packet times when doing LAN transfers? I am still thinking there may be something with the driver or the network stack. Sayyy... What do you have installed/enabled on these machines? Does the slow one have more services or protocols enabled? (like IPX/SPX/NetBIOS ?) It used to be (older Windows crap) that the *order* in which you configured them made significant performance differences. It is much better w/ 2000 & XP, but still an area you might look for differences between the machines.

 

If the network connections are configured the same (and you said they were all XP Pro boxes) then maybe the driver or one card is better/worse than the other. Is one a "motherboard" NIC and another on a daughter card?

 

More stuff to check.

 

Jim

 

 

 

 

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Steve
Sent: Thursday, July 29, 2004 8:06 PM
To: 'Ethereal user support'
Subject: RE: [Ethereal-users] Can you help me diagnose a performance problem?

Thanks for the comments, Jim. I’ve waited a little while before replying in the hope there might have been other responses.

 

With regard to the physical layer, I have physically put the fast PC on the same cable as the slow PC to check, and it is still faster, so that’s not it.

 

I tested some transfers across the LAN. Inbound to the slow PC is always slower. Outbound is OK. Although an Ethereal trace of a “slow” inbound transfer does show one ACK for every 2 segments when transferring across the LAN, and the difference in speed is not so marked as when downloading from the Internet.

 

Steve 

 

 

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Jim Hendrick
Sent: Thursday, 29 July 2004 3:36 PM
To: 'Ethereal user support'
Subject: RE: [Ethereal-users] Can you help me diagnose a performance problem?

 

Hmmm. Not sure why the window sizes are different or the ACK policies differ.

 

Does anyone know how XP handles selective ACK? It seems like the one that is ACKing multiple packets is faster (although this is probably not the reason for the difference).

 

Another basic Q. Is the physical layer identical for both (cables, network drops, patch panels if any, switches, etc. etc.)

 

Can you try a file transfer within your own network? Perhaps even between a "fast" and "slow" machine (in each direction) or from both to (and from) a 3rd machine.

 

This may not point out anything, but it will be a more controlled test.

 

It may be as simple as a physical or a software (card / driver) issue, but what the *reason* behind it is not obvious.

 

 

-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Steve
Sent: Wednesday, July 28, 2004 10:58 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Can you help me diagnose a performance problem?

Hi, first time on the list and not exactly a network specialist, so bear with me!

 

I’ve been struggling with a performance problem where Internet downloads from one machine tend to be about 20% slower than those from other machines on the network (all Win XP Pro). All settings I can think of are identical, and the “slow” machine is about the fastest on the network in all other respects. Ethereal captures do show up some interesting differences. Traffic from a “slow” machine looks like this (hope it formats OK):

  15818 23.220614   144.135.23.54         192.168.0.5           TCP      4000 > 3091 [ACK] Seq=11378574 Ack=0 Win=7086 Len=1446

  15819 23.220806   192.168.0.5           144.135.23.54         TCP      3091 > 4000 [ACK] Seq=0 Ack=11380020 Win=64000 Len=0

  15820 23.229900   144.135.23.54         192.168.0.5           TCP      4000 > 3091 [ACK] Seq=11380020 Ack=0 Win=7086 Len=1446

  15821 23.230082   192.168.0.5           144.135.23.54         TCP      3091 > 4000 [ACK] Seq=0 Ack=11381466 Win=64000 Len=0

Each ACK acknowledges the segment before it, and has a time to ACK the segment of around .00018 seconds.

Traffic from a "fast" machine looks like this:

   4095 5.885410    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3865158 Ack=0 Win=6810 Len=1446

   4096 5.886590    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3866604 Ack=0 Win=6810 Len=1446

   4097 5.886617    192.168.0.4           144.135.23.54         TCP      1101 > 4000 [ACK] Seq=0 Ack=3868050 Win=64000 Len=0

   4098 5.887665    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3868050 Ack=0 Win=6810 Len=1446

   4099 5.889292    144.135.23.54         192.168.0.4           TCP      4000 > 1101 [ACK] Seq=3869496 Ack=0 Win=6810 Len=1446

   4100 5.889346    192.168.0.4           144.135.23.54         TCP      1101 > 4000 [ACK] Seq=0 Ack=3870942 Win=64000 Len=0

Each ACK again acknowledges the segment before it, but only every second segment gets ACK'd. Also the time to send the ACK is now .00003 (much
quicker). I also don't know why the sender's Win size is different in the 2 cases.

 

Can anyone point me in the right direction here? Thanks.

 

Steve