frozen windows source or destination

[xmgr]

when you look at sniffer traces and you get a frozen window line on your decode who sent the msg source or destination

 

[fortunat]

Nobody really sends a 'frozen window' It is an observation that the Expert notes based on the default 5 second threshold. All it really means is that the TCP window size hasn't changed in 3 seconds. May not really mean anything if the TCP Window size is near the maximum it started with.

I even have a short write up on my site, if you want to check it out.

http://www.thetechfirm.com/fluke_networks/tcp_window_frozen.ppt

Hope that helps

'Making things work better; bit by bit.'

 

[Helmuth2]

Good explanation fortunat!
In my opinion this is one of the most stupid expert symptoms, because in 99.9 % there is no problem at all and it makes less experienced troubleshooters investigate in the wrong direction.

Best regards

Helmuth

 

[fortunat]

A better sympton would be if the window gets below a % of the Max WIndow Size, but what do I know..


'Making things work better; bit by bit.'

 

[xmgr]

thanks