"Under the Hood" October 2009 edition
As I imagine most of you are, I’m always looking for performance tuning
ideas, something that really helps improves performance, preferably with minimal
cost. Recently, while reviewing trace files, I discovered the cause of an
issue I was troubleshooting: Nagle’s algorithm had struck again. Don’t
get me wrong, I’m not against Nagle or his algorithm, but I don’t
like it when things work against you, like my wife’s car, which has
an alarm system that locks all the doors, usually when you least expect it.
I like the thought of safety, but lock all the doors but mine. I’ll
lock my own door, thank you..
Nagle's Congestion Control in IP/TCP Internetworks (RFC 896) describes what
he called the 'small packet problem,’ where an application repeatedly
emits data in small chunks, frequently only one byte in size. Since TCP packets
have a 40 byte header (20 bytes for TCP, 20 bytes for IP) and Ethernet 18
byte (14 bytes source and destination, type and 4 bytes CRC), this results
in a 59 byte packet for one byte of useful information, a huge and usually
unnecessary overhead. This situation often occurs in Telnet sessions, where
most key presses generate a single byte of data that is transmitted immediately.
Worse yet, over slow links, many such packets can be in transit at the same
time, potentially leading to congestion collapse.
Just as my wife’s car locks all the doors, with good intentions, Nagle’s
Congestion Control can have a negative effect. In Figure 1:1 a 200 millisecond
delay interrupts the flow of data being transmitted. Using IO Graphs within
Wireshark it become more obvious..
Figure 1:1 Wireshark trace indicating 200 millisecond delays, IP Graphs
with 200 millisecond delays between data throughput spikes
Correcting the problem was straight forward by turning off Nagle’s setting,
a registry setting with Microsoft.
One last word of wisdom: always monitor the results of any tuning configuration
changes carefully to be absolutely sure that it has a positive impact. I always
look through the trace file that is measuring the results to confirm that
the change had a positive effect.
For more technical tips see www.gearbit.com/techtips
Sharkfest 2009 Follow Up
The second annual Sharkfest was a big success and even more exciting than
the first. What sets this conference apart is the core group of network analysts
who contribute information and techniques. From Laura Chapel’s information
on finding hacks and viruses to Jerold Comes sharing his extensive knowledge
of Wireshark core code and how it works. Also, the vendors’ support
and sponsorships add a unique flair. With technology as a core theme, their
focus is on doing what they do and doing it well.
For more information on presentations given by Ray Tompkins at Sharkfest go
to SHARKFEST 09
gearbit Product Announcement
- Monitor - gear up your network with the latest monitoring equipment
- Proactive analysis – catch problems before they affect your users
- Expert Assessment - evaluate and improve your networks performance
The gearbox is equipped with a packet engine that inspects every packet.
This expert deep packet analysis examines each packet for any issues and outputs
accurate, detailed reports defining the problem.
We also include a select group of tools developed with automation intelligence
that are configured for optimal effectiveness in locating network issues.
We provide superior support from knowledgeable network analysts with real
world experience in identifying and solving network issues. The end result
is a cost effective network monitoring solution. Contact us at sales@gearbit.com
gearbit Network Analysis Training
Our Network Analysis training class provides a detailed view of protocols and how they flow through the network. The goal of this course is to empower the analyst with advanced troubleshooting techniques. You will never look at packets the same way. This fascinating view through an analyzer reveals the true nature of a network and the engineering that supports popular technology applications. Key concepts covered include:
- a review of packet traces that have problems at various layers of the OSI
- client and server misconfigurations
- application analysis
- throughput measurement
- performance effectiveness
Cost $695 Network AnalysisTraining – 2 day class. Register here
Austin TX, Nov. 9-10, 2009, Marriott 9409 Stonelake Boulevard
Houston TX, Nov. 12-23, 2009, 519 North Sam Houston Pkwy, Suite 600, Houston, TX 77060
