Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to debug a network issue and am using Wireshark and tcpdump to grab packets from my server. I have one client application that is grabbing all my available connections and then holding them, trying to send A LOT of data and essentially causing an unintentional DOS attack. While debugging I notice that I see my server sending "Window Closed" and "Zero Window" TCP packets - but never sending any "Window Update" packets. I am guessing this is why the client never lets go of the connections (it still has more data to send and is waiting). Has anyone ever seen this type of behavior before? Let's not get into the reasons why I haven't set up an iptables rule to limit concurrent connections (yeah I know). I also recently changed the MTU from 1500 to 9000 - could this have such a negative effect? (Linux) Thanks.

share|improve this question
Do the switches that connect these systems have jumbo frames enabled? – joeqwerty May 19 '10 at 14:11
That's a great question and one I have no answer to. I do not have physical access to the entire network, is there a way to tell this? – Gandalf May 19 '10 at 15:36
This would be for Windows, maybe you can translate it to linux. From one host connected to the switch ping another host on the same switch with the following command: ping -f -l 1473 host2. If the command gives you a "packet needs to be fragmented" message then it's a safe bet that the switch isn't configured for jumbo frames. – joeqwerty May 19 '10 at 16:22
If you have a satisfactory answer, don't forget to mark the question as answered. – Egbert S May 9 at 14:10
up vote 2 down vote accepted

TCP ZeroWindow - Occurs when a receiver advertises a receive window size of zero. This effectively tells the sender to stop sending because the receiver's buffer is full. Indicates a resource issue on the receiver, as the application is not retrieving data from the TCP buffer in a timely manner.

Details in

share|improve this answer
I guess you could say Gandalf's application is seeing TCP segments and saying "you shall not pass". – suprjami Dec 26 '14 at 10:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.