How to Analyze TCP dump for SLOW backends (Demo Using Wireshark)

Tharaka Dissanayake
2 min readJul 19, 2022

--

Sometimes applications may respond slowly. For this problem. Network, Machine, and Infrastructure involvement will affect. So, with this article, we are focusing on that incident.

server.js file

Case1:

After running the server.js file, I sent a request to the port. Then the Wireshark loopback window shows that the server is started.

Sending request to the port
Wireshark window

With the above example, the window size column represents the maximum receive buffer size. initial request the window size is 10231 and the final window size is 10233. This very huge number will make applications slow.

But that window can scale up to 8 which means 2⁸ because in the option it shows it can scall up.

But some requests have no scale option it is happening in the handshake period. Bandwith must be used in full scale.

Case2:

When I upload a file to the server we can see window size is being decreased (dropping gradually).

So the problem occurs due to keeps dropping and its hits like zero. Though we transmit the data in the high-speed Server application who is in layer 7 doesn’t consume the data at the same speed.

For some reason, if it's hit to zero, now it is called a zero window situation. So the Server says to the client that all the space in the buffer is full and the Client needs to wait. Let’s say 1 sec later Server says Window update 30 size and the Server asks the client to send 30. We can see there is a lag because of the zero by zero window there is a lag. It is the reason for the TCP dump for slow.

References: https://www.youtube.com/watch?v=Ca9ZRyzeauo&t=4s&ab_channel=KrishDinesh

--

--

Tharaka Dissanayake
Tharaka Dissanayake

No responses yet