Wireshark · Ethereal-users: Fw: [Ethereal-users] increasing tcp window size

[keith.s.wong@xxxxxxxxxxxxxxxx]

Hi Kevin,

Thanks for replying. I tried to disable protocol decoding on Tethereal but
it doesn't seem to have that feature. So I've had to give you a screen dump
from Ethereal.
Looking at the ACK and SEQ everything looks ok... until the proxy seems to
send an unexpected FIN, ACK. Is it something to do with the proxy? I
haven't got around to tracing the server yet, but if this give no clues
then I will.

(See attached file: trace_snapshot.jpg)

Keith


---------------------- Forwarded by Keith S Wong/AU/MCS/PwC on 07/08/2002
09:40 AM ---------------------------


"keithwong" <keithwong@xxxxxxxxxxxxxxxx> on 07/08/2002 08:05:25 AM

To:    Keith S Wong/AU/MCS/PwC@AsiaPac
cc:
Subject:    Fw: [Ethereal-users] increasing tcp window size


----- Original Message -----
From: Kevin
To: keithwong@xxxxxxxxxxxxxxxx ; ethereal-users@xxxxxxxxxxxx
Sent: Wednesday, August 07, 2002 4:30 AM
Subject: RE: [Ethereal-users] increasing tcp window size

Keith,
The increasing window is a result from the receiver processing the data it
was sent.  This is a fairly normal condition and would not be my prime
focus.

To make heads or tails out of this, we need to know the details for the
frames sent to the server ( 1360, 1362-1365 & 1377 ).  Right now we have no
way of knowing which frame 1367 - 1377 is ack'ing.

Kevin Mason
      -----Original Message-----
      From: ethereal-users-admin@xxxxxxxxxxxx
      [mailto:ethereal-users-admin@xxxxxxxxxxxx] On Behalf Of
      keithwong@xxxxxxxxxxxxxxxx
      Sent: Tuesday, August 06, 2002 9:36
      To: ethereal-users@xxxxxxxxxxxx
      Subject: [Ethereal-users] increasing tcp window size

      Hi everyone,

      I'm working on a web application that requires users to upload files
      onto a web server over ssl. The size of these files range from 50K to
      2.5MB. In our development environments we have no problem uploading
      the largest file. However when this application is run over the
      internet we get unusual problems for large files. Sometimes the file
      successfully uploads however most of the time the upload fails and
      responds with "page not found 400 error". If however we upload the
      file from our clients intranet we have no problem uploading the file.

      The only conclusion I can come to is for some reason the https
      connection drops out. I've taken a dump of the network activity from
      a user's machine at the time when the connection seems to die. This
      was taken on a Windows 2000 machine using IE 5.5. The server machine
      also runs on Windows 2000 and uses IIS 5.

      This is a dump of the trace from Ethereal...

      1358 101.779797      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747331447 Win=3957 Len=0
      1359 101.779983      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747333820 Win=1584 Len=0
      1360 101.780226 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy
      HTTP Continuation
      1361 101.846065      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747335280 Win=7364 Len=0
      1362 101.846128 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy
      HTTP Continuation
      1363 101.846167 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy
      HTTP Continuation
      1364 101.846192 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy
      HTTP Continuation
      1365 101.846213 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy
      HTTP Continuation
      1366 101.850486      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747338200 Win=4444 Len=0
      1367 101.850618      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=2555 Len=0
      1368 102.035648      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=9795 Len=0
      1369 102.231611      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=17035 Len=0
      1370 102.426010      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=24275 Len=0
      1371 102.511702      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=28619 Len=0
      1372 102.595514      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=32963 Len=0
      1373 102.675749      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=37307 Len=0
      1374 102.756940      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=41651 Len=0
      1375 102.981833      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=51787 Len=0
      1376 103.191974      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=59027 Len=0
      1377 103.285043      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [ACK] Seq=1877836663 Ack=747340089 Win=63371 Len=0
      1378 106.678260      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      HTTP Continuation
      1379 106.678429      myproxy -> PWC0002B3050FC7.aap.pwcinternal.com
      TCP 8080 > 1359 [FIN, ACK] Seq=1877836940 Ack=747340089 Win=65535
      Len=0
      1380 106.678469 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy
      TCP 1359 > 8080 [ACK] Seq=747340089 Ack=1877836941 Win=17058 Len=0
      1381 106.678906 PWC0002B3050FC7.aap.pwcinternal.com -> myproxy
      TCP 1359 > 8080 [RST] Seq=747340089 Ack=1877836663 Win=0 Len=0

      It seems the proxy sends back the same ACK message for a while but
      continually increases the window size. It eventually then sends a
      FIN, ACK message to close the connection and IE seems to spit out a
      RST message.

      I'm not exactly sure what this increasing window size means, but
      there must some network settings I can try to configure on the server
      to help alleviate this problem.

      Thanks in advance.

      Cheers,
      Keith




      ---
      Incoming mail is certified Virus Free.
      Checked by AVG anti-virus system (http://www.grisoft.com).
      Version: 6.0.381 / Virus Database: 214 - Release Date: 8/2/2002




_________________________________________________________________
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.   If you received
this in error, please contact the sender and delete the material from any
computer.

Attachment: trace_snapshot.jpg
Description: JPEG image