With the weather getting cold, it seems appropriate to write a tip on the Frozen Window symptom seen on many analyzers.

During the establishment of a TCP connection, each end of the connection advertises its available TCP buffer space for that connection. The buffer space is the window size. When one end of the connection sends data to the other, the size of the transmitted data is subtracted from the available window size. This window size will decrease until the application removes the data from the TCP buffer. If the application layer does not remove the data from the TCP buffer in a timely manner, the advertised buffer space can become small enough to impede application performance.

If the analyzer detects that the advertised window size has dropped below a previously advertised value and does go on back up for a period of time, it will generate a Window Frozen symptom. This decrease in window size can be caused by one of several things:

• Sometimes an analyzer will call out a frozen window without due cause. Some protocol stacks clean up their window size on a schedule that the analyzer thinks is a problem, when it is simply the stack's clean up schedule.

• The application layer of the receiving device may not be able to keep up with the rate at which the sending device is transmitting data. If it observed that the window size drops to zero and stays there for more than several milliseconds, the hardware platform of the receiving station should be evaluated to determine if it is suitable for the intended application.

• The application may not be removing the data from the TCP buffer. We found this problem in an application we were analyzing. Once the window size reaches zero, the sending station will not transmit more data. In this particular application, the window size reached zero after 5 hours and the application crashed.

In all cases, the best way to determine the impact of window size on performance is to measure the throughput of the data transfer between the two devices. If the analyzer you are using supports the relative time and cumulative bytes columns, the throughput can be measured by dividing the number of bytes transferred by the amount of time taken
to complete the transfer.

If the decrease in window size appears to be impacting the application throughput, the application developer should be consulted. It the throughput does not appear to be impacted, it may be that the application clears the buffer on an interval longer than the analyzer expects. In this case the expert symptom should be modified to accommodate the characteristic of the application.

It is important to understand that the values used for many of these expert symptoms are set to suggested values and may not match your network. In order to get accurate symptoms for your network, you may need to customize them based on your traffic loads and application performance.

选编自 NetAnalyst Tip