• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1899
  • Last Modified:

Slow internet transfer

Out of two almost identical Windows PCs in the office, one works fine, but the other one downloads fast only from the sites that are nearby (by nodes).  Our internal LAN is of more than adequate speed.
Ping gives the same speed for both. It seems only TCP transfers depends on the number of nodes between.  

http://speakeasy.net/speedtest/ (it claims it uses TCP) gives fast transfer speed to NY for both PC (we're located in NJ), but to CA it slow for one PC and fast for the other.

LAN is separated from the internet by a firewall (Sonicwall TX170) with NAT

My first question is, - what software should I use for diagnostics, and the second, of course, how can I fix the problem.

My wild guess is that the acknowledge packets generated by the PC with the speed problem are corrupted somehow and then they are lost somewhere on the way back. Does that make sense?
  • 4
2 Solutions
I would make a quick guess and say that the issue is likely a configuration difference between the workstations.

That being said, you can download and install a packet capture software such as wireshark for free to capture the data going to and from the workstations. You would want to load it on both workstations, and run it with a filter for the host  that you are downloading the files from.  This is an admirable pursuit of knowledge, and what you learn is usefull, but it is rare that a network issue causes the issue.

As a wild guess, set the MTU of the slow workstation to 1300 and see if things improve.
zc2Author Commented:
Thank you for the prompt answer, I'll try that and tell you later.
zc2Author Commented:
on the PC with the speed problem I see a number of [TCP retransmission] records.
I copied one of it below.

I'm sorry for my lameness, but where do I set the MTU on a Windows 5.x ?
No.     Time        Source                Destination           Protocol Info
   1304 43.603259               HTTP     [TCP Retransmission] HTTP/1.1 200 OK  (text/html)

Frame 1304 (338 bytes on wire, 338 bytes captured)
    Arrival Time: Dec 16, 2009 15:55:24.967829000
    [Time delta from previous captured frame: 0.077074000 seconds]
    [Time delta from previous displayed frame: 0.109251000 seconds]
    [Time since reference or first frame: 43.603259000 seconds]
    Frame Number: 1304
    Frame Length: 338 bytes
    Capture Length: 338 bytes
    [Frame is marked: False]
    [Protocols in frame: eth:ip:tcp:http:data:data:data-text-lines]
    [Coloring Rule Name: Bad TCP]
    [Coloring Rule String: tcp.analysis.flags]
Ethernet II, Src: Sonicwal_32:f4:b8 (00:06:b1:32:f4:b8), Dst: AsustekC_48:0a:1a (00:0c:6e:48:0a:1a)
    Destination: AsustekC_48:0a:1a (00:0c:6e:48:0a:1a)
        Address: AsustekC_48:0a:1a (00:0c:6e:48:0a:1a)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Sonicwal_32:f4:b8 (00:06:b1:32:f4:b8)
        Address: Sonicwal_32:f4:b8 (00:06:b1:32:f4:b8)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: (, Dst: (
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 324
    Identification: 0xa329 (41769)
    Flags: 0x02 (Don't Fragment)
        0.. = Reserved bit: Not Set
        .1. = Don't fragment: Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 50
    Protocol: TCP (0x06)
    Header checksum: 0x0af4 [correct]
        [Good: True]
        [Bad : False]
    Source: (
    Destination: (
Transmission Control Protocol, Src Port: http (80), Dst Port: prm-nm-np (1403), Seq: 491685, Ack: 23583, Len: 284
    Source port: http (80)
    Destination port: prm-nm-np (1403)
    [Stream index: 1]
    Sequence number: 491685    (relative sequence number)
    [Next sequence number: 491969    (relative sequence number)]
    Acknowledgement number: 23583    (relative ack number)
    Header length: 20 bytes
    Flags: 0x18 (PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgement: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 55480
    Checksum: 0x5202 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
    [SEQ/ACK analysis]
        [Number of bytes in flight: 284]
        [TCP Analysis Flags]
            [This frame is a (suspected) retransmission]
                [Expert Info (Note/Sequence): Retransmission (suspected)]
                    [Message: Retransmission (suspected)]
                    [Severity level: Note]
                    [Group: Sequence]
            [The RTO for this segment was: 0.317657000 seconds]
            [RTO based on delta from frame: 1294]
Hypertext Transfer Protocol
    HTTP/1.1 200 OK\r\n
        [Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]
            [Message: HTTP/1.1 200 OK\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Version: HTTP/1.1
        Response Code: 200
    Date: Wed, 16 Dec 2009 20:55:23 GMT\r\n
    Server: Apache/1.3.29 (Debian GNU/Linux) PHP/4.3.3\r\n
    X-Powered-By: PHP/4.3.3\r\n
    Keep-Alive: timeout=15, max=47\r\n
    Connection: Keep-Alive\r\n
    Transfer-Encoding: chunked\r\n
    Content-Type: text/html; charset=iso-8859-1\r\n
    HTTP chunked response
        Data chunk (10 octets)
            Chunk size: 10 octets
            Data (10 bytes)

0000  73 69 7a 65 3d 31 30 39 30 37                     size=10907
                Data: 73697A653D3130393037
                [Length: 10]
            Chunk boundary
        End of chunked encoding
            Chunk size: 0 octets
            Chunk boundary
Line-based text data: text/html

Open in new window

zc2Author Commented:
I tried to set the MTU to 1300, no any improvements.
zc2Author Commented:

I downloaded SG TCP Optimizer utility (http://www.speedguide.net/downloads.php) , and it gave me the maximum transfer speed.
I don't know what exactly settings it has changed, but definitely it's what I need.

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now