Totally different Window Sizes

[dfusion]

I'm still having a problem with transferring data between as AS400 and a Stratus VOS, both on 100TX full duplex connected via a Foundry Network Big Iron 4000.

I have now captured packets using Microsoft Netmon to compare to my Sniffer capture. One thing I noticed is that the AS400 always has a window size of 8192 and the Stratus Windows size is 11468. However, the packets from the Stratus to the AS400 never seem bigger than 460, so the Window size appears to have no relations.

When I perform a capture I see the Stratus sending data to the AS400. Every packet seems to have the ACK, PSH flagged, but I'm not sure if this is a good thing..? What really throws me is that if the Stratus sends a single packet of 65 bytes, the IBM will reply with four packets - three of which are 0 bytes and the fourth is 57 bytes. The IBM's reply is ALWAYS 57 byes. This probably indicates something, but I'm not sure what. Interface utilization on the Foundry is 1% for each 100TX port and there are no CRC or Runt errors.

Any ideas?

Thanks,
Mark




Sr. Network Engineer
ArcLight Systems, LLC

http://www.markholloway.com

 

[fortunat]

The TCP Window Size is a receiver 'thing'. It's just what the reciever is advertising that it can receive.

Have you checked the TCP Maximum Segment Size (or MSS). You will only see this during the TCP 3 way handshake, or the packets at the begining of the conversation with the SYN flags set.

The default TCP MSS for Ethernet is 1460.

Let me know what you find..

Regards

'Making things work better; bit by bit.'

 

[dfusion]

I know the AS400 has a default MTU size of 1460. I looked at the interface parameters. I have not checked the Stratus as I have to have my Stratus Admin do it. Should the MSS be the same as MTU? I am having a hard time tracking down the MSS. I'm skimming through the packets right now.

Sr. Network Engineer
ArcLight Systems, LLC

http://www.markholloway.com

 

[matttheknife]

If you want to check the MSS, then have a look at the end of the TCP header of the SYN packets of every starting conversation. MSS should be 40 bytes lower than the MTU, MTU includes both, TCP and IP headers.

Normally the Push (PSH) bit is set by the application, when
the sender has less than the MSS to send in his send queue, so that the data gets send out right away. So this could be normal. Why there are 4 frames of responses with almost no data is difficult to say, I'd need a chunk of the trace to have a look at it.
Also, this kind of troubleshooting is really difficult with NetMon, as netmon doesn't decode the applications well at all.
I'll send you my private email address via your contact address. Send me parts of a trace where you have got problems, I'll try to analyze it with a real Sniffer.
Regards
matttheknife