Surveyor User's Guide

10-55
Expert Features
Transport Layer
10
TCP Window Probe
Counter
TCP Window Probe is a counter of all TCP Window Probe events over a period of
time per segment. A count of all TCP Window Probe events displays in the
Overview counters of Expert View. A threshold for this counter can be set in Expert
Alarms.
Expert Symptom
TCP Window Probe events are automatically logged as expert symptoms. The
Symptom Summary field provides information about the well-known ports (WKP)
involved, including the port number and the IP address. For example:
Between [206.250.228.69]/[TCP/IP WKP:1988] and
[206.250.228.11]/[SMTP]
The TCP window size is examined for every packet to check for one-byte data
packets. If a TCP/IP packet with one byte of data is encountered, the event is
logged. One-byte data packets are sent periodically by the sender to see if the
receiver’s window has reopened to allow the sender to resume transmitting.
Diagnostic Details
__________________________________________________________________
Problem Description:
A TCP/IP packet with one byte of data has been sent to check whether the receiver’s
window has been reopened.
__________________________________________________________________
Probable Cause(s):
1. The receiver is overloaded.
2. The receiver has run out of buffer space.
3. The non-responsive receiver intends the sender to close the connection.
4. There may be a problem with the receiver’s TCP/IP stack.
5. There are too many connections to the receiver resulting in reduced buffer space.
__________________________________________________________________
Recommended Action(s):
1. Upgrade the receiver’s CPU and/or Memory.
2. Reduce the number of connections to the receiver.
3. Increase the network bandwidth.