lost and found ( for me ? )

How to enable/disable TCP window scale n’ change scale factor


[root@centos5-1 ~]# uname -r
2.6.18-238.5.1.el5
[root@centos5-1 ~]# cat /etc/redhat-release
CentOS release 5.6 (Final)

On CentOS5 window scale is enabled by default.
[root@centos5-1 ~]# cat /proc/sys/net/ipv4/tcp_window_scaling
1

[ How to disable window scale ]

1 means window scale is enabled.
You can disable window scale by setting tcp_window_scaling to 0
[root@centos5-1 ~]# echo 0 > /proc/sys/net/ipv4/tcp_window_scaling

[ How to change scale factor ]

receive buffer per one socket
[root@centos5-1 ~]# cat /proc/sys/net/ipv4/tcp_rmem
4096 87380 1048576

87380 will be overwritten by a value of /proc/sys/net/core/rmem_default
[root@centos5-1 ~]# cat /proc/sys/net/core/rmem_default
129024

1048576 will be overwritten by a value of /proc/sys/net/core/rmem_max
[root@centos5-1 ~]# cat /proc/sys/net/core/rmem_max
129024

Scale factor is 5 when TCP parameters are above values.
[root@centos5-1 ~]# tshark -r aa.pcap | head -1
Running as user "root" and group "root". This could be dangerous.
 1   0.000000 192.168.11.140 -> 74.125.91.104 TCP 47405 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=1048663 TSER=0 WS=5

so this machine’s window size is multiplied by 2**5 :
[root@centos5-1 ~]# tshark -n -r aa.pcap ip.src==192.168.11.140 and tcp.port==57152 -V | egrep -i "window size"
Running as user "root" and group "root". This could be dangerous.
   Window size: 5840
   Window size: 5856 (scaled)    <- 5856*2**5 = 187392
   Window size: 5856 (scaled)
   Window size: 8736 (scaled)    <- 8736*2**5 = 279552
   Window size: 11648 (scaled)
   Window size: 14528 (scaled)
   Window size: 17344 (scaled)
   Window size: 20256 (scaled)
   Window size: 23136 (scaled)
   Window size: 26048 (scaled)
   Window size: 28928 (scaled)  <- 28928*2**5 = 925696


when window scale is disabled
[root@centos5-1 ~]# tshark -n -r bb.pcap ip.src==192.168.11.140 and tcp.port==50526 -V | egrep -i "window size"
Running as user "root" and group "root". This could be dangerous.
   Window size: 5840
   Window size: 5840
   Window size: 5840
   Window size: 8412
   Window size: 8412
   Window size: 11216
   Window size: 14020
   Window size: 16824
   Window size: 19628
   Window size: 22432
   Window size: 25236
   Window size: 28040


You can change scale factor by editing the value of rmem_default , rmem_max n’ tcp_rmem.

set scale factor to 0
[root@centos5-1 ~]# echo "4096 65535 65535" > /proc/sys/net/ipv4/tcp_rmem
[root@centos5-1 ~]# echo 65535 > /proc/sys/net/core/rmem_default
[root@centos5-1 ~]# echo 65535 > /proc/sys/net/core/rmem_max  

[root@centos5-1 ~]# tshark -n -r zz.pcap | head -1
Running as user "root" and group "root". This could be dangerous.
 1   0.000000 192.168.11.140 -> 72.14.203.104 TCP 48507 > 80 [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=2227822 TSER=0 WS=0

[root@centos5-1 ~]# tshark -n -r zz.pcap ip.src==192.168.11.140 and tcp.port==41430 -V | egrep -i "window size"
Running as user "root" and group "root". This could be dangerous.
   Window size: 5840  <- 5840*2**0 = 5840
   Window size: 5840
   Window size: 5840
   Window size: 8412
   Window size: 8412
   Window size: 11216
   Window size: 14020
   Window size: 16824
   Window size: 19628
   Window size: 22432
   Window size: 25236
   Window size: 25236

   Window size: 5840
   Checksum: 0x5df4 [correct]
       [Good Checksum: True]
       [Bad Checksum: False]
   Options: (20 bytes)
       Maximum segment size: 1460 bytes
       SACK permitted
       Timestamps: TSval 2227960, TSecr 0
       NOP
       Window scale: 0 (multiply by 1)

set scale factor to 1 ( 65535*2**1 = 131070 )
[root@centos5-1 ~]# echo 131070 > /proc/sys/net/core/rmem_default
[root@centos5-1 ~]# echo 131070 > /proc/sys/net/core/rmem_max
[root@centos5-1 ~]# echo "4096 131070 131070" > /proc/sys/net/ipv4/tcp_rmem

[root@centos5-1 ~]# tshark -n -r cc.pcap ip.src==192.168.11.140 and tcp.port==57780 | head -1
Running as user "root" and group "root". This could be dangerous.
18   0.144861 192.168.11.140 -> 64.233.183.104 TCP 57780 > 80 [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=2760408 TSER=0 WS=1

[root@centos5-1 ~]# tshark -n -r cc.pcap ip.src==192.168.11.140 and tcp.port==57780 -V | egrep -i scale
Running as user "root" and group "root". This could be dangerous.
       Window scale: 1 (multiply by 2)
   Window size: 5840 (scaled)
   Window size: 5840 (scaled)
   Window size: 8736 (scaled)
   Window size: 11632 (scaled)
   Window size: 14528 (scaled)
   Window size: 17332 (scaled)
   Window size: 20228 (scaled)
   Window size: 23124 (scaled)
   Window size: 26020 (scaled)
   Window size: 28916 (scaled) <- 28916*2**1

set scale factor to 8 ( 65535*2**8= 16776960 )
[root@centos5-1 ~]# echo "4096 16776960 16776960" > /proc/sys/net/ipv4/tcp_rmem  
[root@centos5-1 ~]# echo 16776960 > /proc/sys/net/core/rmem_default
[root@centos5-1 ~]# echo 16776960 > /proc/sys/net/core/rmem_max

[root@centos5-1 ~]# tshark -r dd.pcap ip.src==192.168.11.140 | egrep -i syn
Running as user "root" and group "root". This could be dangerous.
 3   1.391173 192.168.11.140 -> 74.125.95.104 TCP 51852 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=3291341 TSER=0 WS=8

[root@centos5-1 ~]# tshark -r dd.pcap ip.src==192.168.11.140 and tcp.port==40520 -V | egrep -i scale
Running as user "root" and group "root". This could be dangerous.
       Window scale: 8 (multiply by 256)
   Window size: 5888 (scaled)  <- 5888*2**8 = 1507328
   Window size: 5888 (scaled)
   Window size: 8960 (scaled)
   Window size: 11776 (scaled)
   Window size: 14592 (scaled)
   Window size: 17408 (scaled)
   Window size: 20480 (scaled)
   Window size: 23296 (scaled)
   Window size: 26112 (scaled)
   Window size: 28928 (scaled)

Thx for reading :)

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.