Slow internet transfer

Posted on 2009-12-16
Last Modified: 2013-12-06
Out of two almost identical Windows PCs in the office, one works fine, but the other one downloads fast only from the sites that are nearby (by nodes).  Our internal LAN is of more than adequate speed.
Ping gives the same speed for both. It seems only TCP transfers depends on the number of nodes between. (it claims it uses TCP) gives fast transfer speed to NY for both PC (we're located in NJ), but to CA it slow for one PC and fast for the other.

LAN is separated from the internet by a firewall (Sonicwall TX170) with NAT

My first question is, - what software should I use for diagnostics, and the second, of course, how can I fix the problem.

My wild guess is that the acknowledge packets generated by the PC with the speed problem are corrupted somehow and then they are lost somewhere on the way back. Does that make sense?
Question by:zc2
    LVL 10

    Assisted Solution

    I would make a quick guess and say that the issue is likely a configuration difference between the workstations.

    That being said, you can download and install a packet capture software such as wireshark for free to capture the data going to and from the workstations. You would want to load it on both workstations, and run it with a filter for the host  that you are downloading the files from.  This is an admirable pursuit of knowledge, and what you learn is usefull, but it is rare that a network issue causes the issue.

    As a wild guess, set the MTU of the slow workstation to 1300 and see if things improve.
    LVL 18

    Author Comment

    Thank you for the prompt answer, I'll try that and tell you later.
    LVL 18

    Author Comment

    on the PC with the speed problem I see a number of [TCP retransmission] records.
    I copied one of it below.

    I'm sorry for my lameness, but where do I set the MTU on a Windows 5.x ?
    No.     Time        Source                Destination           Protocol Info
       1304 43.603259               HTTP     [TCP Retransmission] HTTP/1.1 200 OK  (text/html)
    Frame 1304 (338 bytes on wire, 338 bytes captured)
        Arrival Time: Dec 16, 2009 15:55:24.967829000
        [Time delta from previous captured frame: 0.077074000 seconds]
        [Time delta from previous displayed frame: 0.109251000 seconds]
        [Time since reference or first frame: 43.603259000 seconds]
        Frame Number: 1304
        Frame Length: 338 bytes
        Capture Length: 338 bytes
        [Frame is marked: False]
        [Protocols in frame: eth:ip:tcp:http:data:data:data-text-lines]
        [Coloring Rule Name: Bad TCP]
        [Coloring Rule String: tcp.analysis.flags]
    Ethernet II, Src: Sonicwal_32:f4:b8 (00:06:b1:32:f4:b8), Dst: AsustekC_48:0a:1a (00:0c:6e:48:0a:1a)
        Destination: AsustekC_48:0a:1a (00:0c:6e:48:0a:1a)
            Address: AsustekC_48:0a:1a (00:0c:6e:48:0a:1a)
            .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
            .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        Source: Sonicwal_32:f4:b8 (00:06:b1:32:f4:b8)
            Address: Sonicwal_32:f4:b8 (00:06:b1:32:f4:b8)
            .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
            .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        Type: IP (0x0800)
    Internet Protocol, Src: (, Dst: (
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 324
        Identification: 0xa329 (41769)
        Flags: 0x02 (Don't Fragment)
            0.. = Reserved bit: Not Set
            .1. = Don't fragment: Set
            ..0 = More fragments: Not Set
        Fragment offset: 0
        Time to live: 50
        Protocol: TCP (0x06)
        Header checksum: 0x0af4 [correct]
            [Good: True]
            [Bad : False]
        Source: (
        Destination: (
    Transmission Control Protocol, Src Port: http (80), Dst Port: prm-nm-np (1403), Seq: 491685, Ack: 23583, Len: 284
        Source port: http (80)
        Destination port: prm-nm-np (1403)
        [Stream index: 1]
        Sequence number: 491685    (relative sequence number)
        [Next sequence number: 491969    (relative sequence number)]
        Acknowledgement number: 23583    (relative ack number)
        Header length: 20 bytes
        Flags: 0x18 (PSH, ACK)
            0... .... = Congestion Window Reduced (CWR): Not set
            .0.. .... = ECN-Echo: Not set
            ..0. .... = Urgent: Not set
            ...1 .... = Acknowledgement: Set
            .... 1... = Push: Set
            .... .0.. = Reset: Not set
            .... ..0. = Syn: Not set
            .... ...0 = Fin: Not set
        Window size: 55480
        Checksum: 0x5202 [validation disabled]
            [Good Checksum: False]
            [Bad Checksum: False]
        [SEQ/ACK analysis]
            [Number of bytes in flight: 284]
            [TCP Analysis Flags]
                [This frame is a (suspected) retransmission]
                    [Expert Info (Note/Sequence): Retransmission (suspected)]
                        [Message: Retransmission (suspected)]
                        [Severity level: Note]
                        [Group: Sequence]
                [The RTO for this segment was: 0.317657000 seconds]
                [RTO based on delta from frame: 1294]
    Hypertext Transfer Protocol
        HTTP/1.1 200 OK\r\n
            [Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]
                [Message: HTTP/1.1 200 OK\r\n]
                [Severity level: Chat]
                [Group: Sequence]
            Request Version: HTTP/1.1
            Response Code: 200
        Date: Wed, 16 Dec 2009 20:55:23 GMT\r\n
        Server: Apache/1.3.29 (Debian GNU/Linux) PHP/4.3.3\r\n
        X-Powered-By: PHP/4.3.3\r\n
        Keep-Alive: timeout=15, max=47\r\n
        Connection: Keep-Alive\r\n
        Transfer-Encoding: chunked\r\n
        Content-Type: text/html; charset=iso-8859-1\r\n
        HTTP chunked response
            Data chunk (10 octets)
                Chunk size: 10 octets
                Data (10 bytes)
    0000  73 69 7a 65 3d 31 30 39 30 37                     size=10907
                    Data: 73697A653D3130393037
                    [Length: 10]
                Chunk boundary
            End of chunked encoding
                Chunk size: 0 octets
                Chunk boundary
    Line-based text data: text/html

    Open in new window

    LVL 18

    Author Comment

    I tried to set the MTU to 1300, no any improvements.
    LVL 18

    Accepted Solution


    I downloaded SG TCP Optimizer utility ( , and it gave me the maximum transfer speed.
    I don't know what exactly settings it has changed, but definitely it's what I need.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Many network operators, engineers, and administrators do not take several factors into consideration when troubleshooting network throughput and latency issues.  They often  measure the throughput by performing a measurement  by transferring a large…
    PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now