What does that
Window field in the TCP header do?
Many people ask this question after capturing a trace file with Wireshark. What is the TCP Window? How does it work? How can I use it to troubleshoot performance problems?
We will answer these questions and more in this nine minute video. Check it out!
Note: This video focuses on the TCP Receive window. We will cover the send window in another video.
Hi Chris, I haven't been able to figure out why sometimes instead of Keep-Alive you can also see ZeroWindowProbe (ZWP) after a Zero Window? I know the Keep-Alive and ZWP is doing the same thing in the instance of Zero Window, but what are their differences?
Your contents and explanations are superb! Much appreciate the work and knowledge you share.
Mike,
Seare
Hi Mike, thank you very much for the comment. That is a great idea for a video! I'll shoot one about that.
In short - the functional difference between a keep-alive and a Zero Window Probe is how the sequence and acknowledgement numbers are used. A Keep-Alive will backup one byte in the sequence number, causing the other side to ack with the original acknowledgement number. A ZeroWindowProbe will send a "Garbage" byte to the other side, incrementing the sequence number by one. If there is still no window, the other side will use the original ack number and send a ZeroWindowProbeAck, which will not ack the Garbage byte.
So both keep the connection open and fundamentally cause the other side to advertise whether the window is still at zero, they just accomplish it in different ways. Hope that helps! Look for a video about this soon. Thanks Mike.