TCP module: Difference between revisions

Jump to navigation Jump to search
m
→‎TCP handshake: Reformatting and rewording
m (→‎TCP zero window: link to common table columns page)
m (→‎TCP handshake: Reformatting and rewording)
Line 31: Line 31:
Below the graph there is the list of all servers with the following columns:
Below the graph there is the list of all servers with the following columns:


* IP: The server IP. Clicking on it leads to a subpage listing all TCP connections.
* IP (see [[Common table columns#IP|Common table columns - IP]]): The server IP. Clicking on ''TCP statistics'' leads to the IP module subpage listing all TCP connections.
* No of handshake: The number of TCP requests/responses seen for this IP address.
* No of handshake: The number of TCP requests/responses seen for this IP address.
* Avg handshake time: This is the average handshake time for this IP address.
* Avg handshake time: This is the average handshake time for this IP address.
Line 51: Line 51:


This tab shows the continuous measurement of TCP response times. The time measured is the interval between a transfer of data and the respective acknowledgement.
This tab shows the continuous measurement of TCP response times. The time measured is the interval between a transfer of data and the respective acknowledgement.
The graph on the top shows a minimum, maximum and average response time over all TCP connections observed.
The graph on the top shows a minimum, maximum and average response time over all TCP connections observed.
The IP list below shows the minimum, maximum and average response time for each IP address.
The IP list below shows the minimum, maximum and average response time for each IP address.




Line 61: Line 64:


=== Garbage bytes ===
=== Garbage bytes ===
Garbage bytes are single bytes sent as part of TCP keep alive packets that have already been acknowledge before by the receiver the data. Some TCP implementations sent single bytes as keep alive packets instead of just empty ACK packets. The retransmitted byte has already been acknowledge and may be the same or different as the original byte of the same sequence number. The TCP stack of the receiver will discard this byte. Technically it is a retransmitted byte, but since it is already acknowledge and will be discarded, we account this byte as a garbage byte to not show as part of regular retransmissions.
Garbage bytes are single bytes sent as part of TCP keep alive packets that have already been acknowledged before by the receiver the data. Some TCP implementations send single bytes as keep alive packets instead of just empty ACK packets. The retransmitted byte has already been acknowledge and may be the same or different as the original byte of the same sequence number. The TCP stack of the receiver will discard this byte. Technically it is a retransmitted byte, but since it is already acknowledged and will be discarded, we account this byte as a garbage byte to not show as part of regular retransmissions.


=== Missed data ===
=== Missed data ===
Line 71: Line 74:
Example:  
Example:  


If there is a transfer of 500 mbit/s going in the network but the mirror port only outputs 100 mbit/s, the Allegro Network Multimeter of course can only account those 100 mbit/s. But based on the TCP sequence numbers, we can estimate that the remaining 400 mbit/s has been missed. This portion is visible in the missed data graph.
If there is a transfer of 500 Mbit/s going in the network but the mirror port only outputs 100 Mbit/s, the Allegro Network Multimeter of course can only account those 100 Mbit/s. But based on the TCP sequence numbers, we can estimate that the remaining 400 Mbit/s has been missed. This portion is visible in the missed data graph.


Usually one can expect to see no missed data at all, especially in inline mode, but it can still happen that there is a small amount of bytes not seen due to multiple reason. One reason is corrupt data where TCP sequence numbers are wrong on purpose. There can also be situations where TCP packets are not seen but actually sent, for example, if they are dropped in some other network component.
Usually one can expect to see no missed data at all, especially in inline mode, but it can still happen that there is a small amount of bytes not seen due to multiple reason. One reason is corrupt data where TCP sequence numbers are wrong on purpose. There can also be situations where TCP packets are not seen but actually sent, for example, if they are dropped in some other network component.
183

edits

Navigation menu