> What I found:
>
> Total packets transacted: ftp-1950 http-1930
> Packets curl -> server ftp-1267 http-1255
> Packets server -> curl ftp-683 http-675
>
> So no great diff there, both send about the same amount of packets.
> A quick look shows that we always send full packets (1460) for both
> uploads. The server window never drops to 0 but one diff is that
> the http window always remains pretty much fully open (opens at
> 17520 and never falls very far beneath that). The ftp window opens
> at 17520 and drops as low as 5840 several times.
> Interesting.....but what does it mean????
>
> My only guess is maybe the server ACKs come back quicker from the
> ftp server? But why would this be, and since the server window
> never drops to 0 what does it even matter?
 
Keep in mind that the sender may have the window filled even when no 0
window segments arrive from the reciever. The sender takes the
reciever's ACK sequence number, and compares that with the sender's
highest sequence number outstanding on the network and the window in
the header. So, if the receiver sends a 17520 window with an ACK seqno
of say 1 (to keep things simple :) and the sender has sent data out to
seqno 17521, then the sender has filled the available window.
 
If the window advertised by the reciever shrinks, it means that the
recieving TCP has received the data, but the receiving app has not
consumed it. If the window advertised by the receiver remains at the
highest value as the ACK seqno advances it means that the receiving
app is keeping-up with the data flow.
 
> Is there any tool that can take a tcpdump file and analyze it for things
> like this? Reading through the response times for 3800+ packets seems a
> bit tedious....
 
I've generally used tcptrace and xplot. Tcptrace can generate
summaries of connections (for the flow in each direction) and can
generate xplot (a specific xplot variant, there seem to be many xplots
:) data files for a visual analysis.
 
rick jones

-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
Received on 2002-12-05