1

I am trying to debug a network issue and am using Wireshark and tcpdump to grab packets from my server. I have one client application that is grabbing all my available connections and then holding them, trying to send A LOT of data and essentially causing an unintentional DOS attack. While debugging I notice that I see my server sending "Window Closed" and "Zero Window" TCP packets - but never sending any "Window Update" packets. I am guessing this is why the client never lets go of the connections (it still has more data to send and is waiting). Has anyone ever seen this type of behavior before? Let's not get into the reasons why I haven't set up an iptables rule to limit concurrent connections (yeah I know). I also recently changed the MTU from 1500 to 9000 - could this have such a negative effect? (Linux) Thanks.

4
  • Do the switches that connect these systems have jumbo frames enabled?
    – joeqwerty
    May 19, 2010 at 14:11
  • That's a great question and one I have no answer to. I do not have physical access to the entire network, is there a way to tell this?
    – Gandalf
    May 19, 2010 at 15:36
  • 2
    This would be for Windows, maybe you can translate it to linux. From one host connected to the switch ping another host on the same switch with the following command: ping -f -l 1473 host2. If the command gives you a "packet needs to be fragmented" message then it's a safe bet that the switch isn't configured for jumbo frames.
    – joeqwerty
    May 19, 2010 at 16:22
  • If you have a satisfactory answer, don't forget to mark the question as answered. May 9, 2016 at 14:10

1 Answer 1

2

TCP ZeroWindow - Occurs when a receiver advertises a receive window size of zero. This effectively tells the sender to stop sending because the receiver's buffer is full. Indicates a resource issue on the receiver, as the application is not retrieving data from the TCP buffer in a timely manner.

Details in http://wiki.wireshark.org/TCP_Analyze_Sequence_Numbers

2
  • 2
    I guess you could say Gandalf's application is seeing TCP segments and saying "you shall not pass".
    – suprjami
    Dec 26, 2014 at 10:49
  • 'We shall pass'. Sep 14, 2016 at 22:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .