Anyone have idea where the loss rate for Server (AMD->client) in between (3-10%) ? There's occasion Zero window size event occurs. What will be likely causes ?
1) WAN Link congestion ?
2) Client is busy
3) Client close Web browser or Applications ?
Answer by Kris Z. ·
Zero client window size events clearly indicate that client can't keep up with receiving data stream being sent by the server. If server wouldn't react to this flag, or ti would be too late to react anyway, client will have no choice than drop packets on its interface and don't send ACK for these packets. The effect would be server loss rate on the AMD to the client link. So the compute resources contingency on the client may be the cause (or the poorly configured NIC with too small buffers).
That's one of the hypotheses.
But it doesn't have to be the client device itself. We've sen cases where the culprit was the WAN optimization controller (again, due to non-optimal configuration - see this blog). The WOC on the client location side may be sending zero window size events or drop packets - when transparent optimization is in use (e.g. WAAS uses this approach), from the AMD vantage point it would look as if the client was dropping the packets. Similar thing would happen when client is behind a firewall, transparent proxy, or other device that analyzes session flow and may get overloaded.
Another possibility is that zero window size events and packet retransmissions may not be correlated and the client is sometimes slowing the transmission down, but the loss occurs on some other network segments that are on the way from server to the client. It has to be remembered that AMD tracks and measures client-sever sessions on L3-L4 level, so the client is a client in the TCP sense, same with the server. L4-transparent devices like firewalls will not be visible as network nodes for the AMD.
Hope this helps.