Tcp rst error rates


#1

Hello

We have been looking at the performance of a group of web servers and there are two TCP error types which are looking troublesome, but not sure what the acceptable rates would be.

For the bunch of 8 servers, the RST levels (client end only) for the 3 busiest servers are running at 12-15% of the transmission rate, the others are running at around 8%

The same 3 severs also have between 3-5% client end Zero Windows as well. On investigation the PCs (its a College) are all quite old and Wins 7 has been shoe horned onto them so I’m putting this down to lack of resources on the PCs slowing the data transfer, but I’m not sure if this is related to the RST levels directly or not.

The description of the RST is a forced termination of the session, possibly page not loading and or the users giving up, but are these levels excessive and can this be related to the Zero Windows or is this something else?

Any thoughts would be welcome


#2

Hi there

When you say that the resets are 12-15% of the transmissions, which figure are you using to calculate the total transmissions? I just want to do a comparison of the systems I have access to in order to work out if the 12-15% is reasonable or something to be concerned about.

I’d say that the fact the clients are sending zero windows events to the servers are certainly a sign that they’re being overwhelmed in terms of the data being sent to them. The big question that we’d need to work out is whether the resets directly correlate with the zero windows (e.g. they’re both related to overwhelmed client PCs), or whether they’re indicative of another problem.

Cheers

Pete


#3

Hi Pete, following this up I found the client PCs are about 8 years old and have Win7 shoe horned onto them and a max memory of 2 Gig, some have 1. On that basis I am reckoning that the client end has very little resource left to do any actual work. The transmitted packets from the server to the client was the value I used to work the Percentage out.


#4

I don’t think I’ve ever seen an RST due to 0 window update. If the window is 0, then either the flow stops, or data is dropped and retransmissions happen.

An RST is usually indicative (but not always) when there is a communication attempt to a non-open port (like a port scan or an old application has been removed), or when an existing communication session has been torn down, usually with a FIN, but the other side is still transmitting.

If the servers are really busy, could the TCP session be in a timeout period and in a half-closed state waiting on a long response from the server? Check with netstat.