Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to debug a network issue and am using Wireshark and tcpdump to grab packets from my server. I have one client application that is grabbing all my available connections and then holding them, trying to send A LOT of data and essentially causing an unintentional DOS attack. While debugging I notice that I see my server sending "Window Closed" and "Zero Window" TCP packets - but never sending any "Window Update" packets. I am guessing this is why the client never lets go of the connections (it still has more data to send and is waiting). Has anyone ever seen this type of behavior before? Let's not get into the reasons why I haven't set up an iptables rule to limit concurrent connections (yeah I know). I also recently changed the MTU from 1500 to 9000 - could this have such a negative effect? (Linux) Thanks.

share|improve this question
    
Do the switches that connect these systems have jumbo frames enabled? –  joeqwerty May 19 '10 at 14:11
    
That's a great question and one I have no answer to. I do not have physical access to the entire network, is there a way to tell this? –  Gandalf May 19 '10 at 15:36
2  
This would be for Windows, maybe you can translate it to linux. From one host connected to the switch ping another host on the same switch with the following command: ping -f -l 1473 host2. If the command gives you a "packet needs to be fragmented" message then it's a safe bet that the switch isn't configured for jumbo frames. –  joeqwerty May 19 '10 at 16:22

1 Answer 1

TCP ZeroWindow - Occurs when a receiver advertises a receive window size of zero. This effectively tells the sender to stop sending because the receiver's buffer is full. Indicates a resource issue on the receiver, as the application is not retrieving data from the TCP buffer in a timely manner.

Details in http://wiki.wireshark.org/TCP_Analyze_Sequence_Numbers

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.