[OT] Network "In Flight" data sizes

[Dave Johnson]

Star writes:
> Does anyone know of a tool that will help determine
> Internet-application performance throughput for overall data window
> size?
> 
> My company has a client that depends on a hosted application.  While
> only one of their offices used this app, things worked very well for
> them.  Now that they're rolling it globally, they're noticing
> significant slowdowns in certain areas.  We already use Akamai and
> some fairly extreme caching settings to keep the dead-bits to a
> minimum, but the dynamic parts are showing some trouble.
> 
> Essentially, they're telling us that they're seeing choke points in
> the 8k range for throughput.  We've gone through all of our equipment
> and assured that we're using 64k windows sizes on the send and receive
> sides.  Still they see this.  It's one of those "it must be on your
> end" discussions and we're working hard to get all the data that they
> request, but it's hard to quantify this "in flight" number that they
> keep touting and showing pretty graphs of.
> 
> The tool that the client's group is using is Opnet IT Guru/ACE which
> is a fine tool...  but if I can get a req for $50k for software in
> under 6 months, Hell may have a need for those double hockey-sticks...
> 
> Any advice is much appreciated.
> 
> ~ Star

FYI: linux should be using window size scaling to get windows larger than
64k (there's a sysctl to turn this off, but I think it's on by
default).

But more fundamentilly, a tcpdump/ethereal/etc.. will easially tell
you the amount of data outstanding, and netstat/etc... will tell you
the fullness of socket buffers.

If that isn't helping you should get a capture on both sides so you
can compare to make sure there isn't any proxy or evil router/firewall
mucking with your tcp stream (i.e. reassemble, then add un-QoS,
jitter, backpressure, shaping, random drops, etc...)

Any retransmitions, SACKs, etc.. are a sign of packet loss, if you see
flags or window sizes showing up magically changing from when the same
packet was sent then some intermidiate device is changing them.

-- 
Dave