?
Solved

What is a TCP Window Update?

Posted on 2008-09-29
8
Medium Priority
?
14,318 Views
Last Modified: 2013-11-13
I'm writing a web service client and I'm getting a lot of TCP Window Update packets in my Wireshark capture.  What are they and are they bad?

Thanks!
0
Comment
Question by:pbenito
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 12

Expert Comment

by:bhnmi
ID: 22599341
Can you post the packet? Most likely its just chatter  to the MS update server, but I am not sure.
0
 

Author Comment

by:pbenito
ID: 22599516
Frame 3881 (60 bytes on wire, 60 bytes captured)
Transmission Control Protocol, Src Port: http (80), Dst Port: tapestry (1922), Seq: 1, Ack: 2778606, Len: 0
    Source port: http (80)
    Destination port: tapestry (1922)
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2778606    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0x91ac [correct]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a tcp window update]
0
 
LVL 12

Expert Comment

by:bhnmi
ID: 22599530
I believe that is web traffic.
0
Limited time offer using promo code EXPERTS25

Designed with a wealth of functionality and convenience, ATEN's new Thunderbolt™ 2 Sharing Switch takes your Thunderbolt setup to the next level. Now through August 31, 2017, Experts Exchange members get 25% off the US7220 on the ATEN USA eShop using promo code EXPERTS25.

 

Author Comment

by:pbenito
ID: 22599540
What does it mean?
0
 
LVL 12

Accepted Solution

by:
bhnmi earned 1500 total points
ID: 22599561
Frame 3881 (60 bytes on wire, 60 bytes captured)
Transmission Control Protocol, Src Port: http (80), Dst Port: tapestry (1922), Seq: 1, Ack: 2778606, Len: 0
    Source port: http (80)
    Destination port: tapestry (1922)
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 2778606    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size: 65535
    Checksum: 0x91ac [correct]
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [This is a tcp window update]


The destination port says tapestry.

http://tapestry.apache.org/
0
 

Expert Comment

by:tcrick
ID: 22890155
Do you see TCP ZeroWindow and/or TCP Zero_WindowProbe?
It means one side of the communications receive buffer was full and could not receive anymore data.  It thens sends a zero window, the other side then sends a zero window probe to see if the window is still in the zero window state.  Then zero window updates are sent to renegotiate the window size.
0
 

Author Comment

by:pbenito
ID: 22891628
Thanks!  
0
 

Expert Comment

by:JasonMewes
ID: 23203492
The tcp window specifies how much data can be in transit.

One way of looking at it is a method to let the "sender" know how much buffer space is available at the "receivers" end so that the sender does not send more data than the receiver can handle.

Window updates are usually performed as part of "normal" packet that contains data. Every time a tcp packet goes back from the receiving end it includes it's current window size/buffer space available so essentially every tcp packet is also a window update (although it is not marked as such).

However, on a (mostly) unidirectional connection (ie, data only flows in one direction) the receiver has no "normal" outgoing packets. It will still have to let the sender know of it's window size, because otherwise the sender will eventually think that the receivers buffers are full.

These updates are called window updates and are essentially a tcp packet that has no data and is sent with no other purpose than to let the sender know that the space available in the receivers buffer has increased.

Depending on your implementation they may anything from completely legit to a slight waste of bandwidth. Likely the former.
1

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SSL is a very common protocol used these days when browsing the web.  The purpose is to provide security to communication, but how does it do it?  There are several pieces at work that have to be setup before SSL will even work and it requires both …
This is the first one of a series of articles I’ll be writing to address technical issues that are always referred to as network problems. The network boundaries have changed, therefore having an understanding of how each piece in the network  puzzl…
Viewers will learn how to properly install and use Secure Shell (SSH) to work on projects or homework remotely. Download Secure Shell: Follow basic installation instructions: Open Secure Shell and use "Quick Connect" to enter credentials includi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

741 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question