<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:georss="http://www.georss.org/georss" xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" xmlns:media="http://search.yahoo.com/mrss/"
		>
<channel>
	<title>Comments on: Network Monitoring Experimentations 1</title>
	<atom:link href="http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/feed/" rel="self" type="application/rss+xml" />
	<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/</link>
	<description>Miscellaneous Random Oracle Topics: Stop, Think, ... Understand</description>
	<lastBuildDate>Thu, 23 May 2013 04:02:42 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.com/</generator>
	<item>
		<title>By: ghassem koolivand</title>
		<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/#comment-2940</link>
		<dc:creator><![CDATA[ghassem koolivand]]></dc:creator>
		<pubDate>Sat, 12 Mar 2011 11:24:55 +0000</pubDate>
		<guid isPermaLink="false">http://hoopercharles.wordpress.com/?p=318#comment-2940</guid>
		<description><![CDATA[Hi Charles
Thank you
I got it but I have problem to set it in Linux and HP-UX.I can set it in Windows but unfortunately I have not found a parameter to set TCP ACK Frequency in ones. Could you help me to set it

Ghassem]]></description>
		<content:encoded><![CDATA[<p>Hi Charles<br />
Thank you<br />
I got it but I have problem to set it in Linux and HP-UX.I can set it in Windows but unfortunately I have not found a parameter to set TCP ACK Frequency in ones. Could you help me to set it</p>
<p>Ghassem</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Charles Hooper</title>
		<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/#comment-2935</link>
		<dc:creator><![CDATA[Charles Hooper]]></dc:creator>
		<pubDate>Thu, 10 Mar 2011 12:03:38 +0000</pubDate>
		<guid isPermaLink="false">http://hoopercharles.wordpress.com/?p=318#comment-2935</guid>
		<description><![CDATA[Ghassem,

Think about it this way:
You are playing a game of catch with your friend who is on the other side of a tall fence.  You have a basket full of baseballs, each of which is numbered.  You know that after every two baseballs you throw, your friend will shout back: &quot;I caught both of the baseballs&quot;.  If he only receives one of the baseballs, eventually (0.2 seconds for the computer network communication) he will shout over the fence &quot;I only received the second baseball, the first one was lost&quot; - at this point you will write a #1 on a baseball and throw that baseball over the fence; when this happens, your friend will immediately shout back &quot;I received the first baseball, please continue throwing&quot;.

Now think about this small change to the situation:
You think that your friend will shout back after every two baseballs are received, while he thinks that he should only tell you when he receives 13 baseballs.  You throw the first two baseballs and wait for an acknowledgement from your friend that the first two baseballs were received.  Your friend is still waiting for baseballs 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13 before telling you that he received the first two.  After a while (0.2 seconds for the computer network communication), your friend gives up and shouts over the wall &quot;I received baseballs #1 and #2, but baseballs 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13 were lost, please send those again&quot;.  At this point you might shout back at your friend that you never threw baseballs 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13.

The computer network communication is a bit more complicated than the above example.  In computer network communication, you could have been in the process of throwing baseballs #3 &amp; #4, and #5 &amp; #6 while waiting for your friend to acknowledge the receipt of baseballs #1 &amp; #2, but you would also expect to receive ACKs for baseballs #3 &amp; #4, and #5 &amp; #6.]]></description>
		<content:encoded><![CDATA[<p>Ghassem,</p>
<p>Think about it this way:<br />
You are playing a game of catch with your friend who is on the other side of a tall fence.  You have a basket full of baseballs, each of which is numbered.  You know that after every two baseballs you throw, your friend will shout back: &#8220;I caught both of the baseballs&#8221;.  If he only receives one of the baseballs, eventually (0.2 seconds for the computer network communication) he will shout over the fence &#8220;I only received the second baseball, the first one was lost&#8221; &#8211; at this point you will write a #1 on a baseball and throw that baseball over the fence; when this happens, your friend will immediately shout back &#8220;I received the first baseball, please continue throwing&#8221;.</p>
<p>Now think about this small change to the situation:<br />
You think that your friend will shout back after every two baseballs are received, while he thinks that he should only tell you when he receives 13 baseballs.  You throw the first two baseballs and wait for an acknowledgement from your friend that the first two baseballs were received.  Your friend is still waiting for baseballs 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13 before telling you that he received the first two.  After a while (0.2 seconds for the computer network communication), your friend gives up and shouts over the wall &#8220;I received baseballs #1 and #2, but baseballs 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13 were lost, please send those again&#8221;.  At this point you might shout back at your friend that you never threw baseballs 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13.</p>
<p>The computer network communication is a bit more complicated than the above example.  In computer network communication, you could have been in the process of throwing baseballs #3 &amp; #4, and #5 &amp; #6 while waiting for your friend to acknowledge the receipt of baseballs #1 &amp; #2, but you would also expect to receive ACKs for baseballs #3 &amp; #4, and #5 &amp; #6.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: ghassem koolivand</title>
		<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/#comment-2934</link>
		<dc:creator><![CDATA[ghassem koolivand]]></dc:creator>
		<pubDate>Thu, 10 Mar 2011 08:24:56 +0000</pubDate>
		<guid isPermaLink="false">http://hoopercharles.wordpress.com/?p=318#comment-2934</guid>
		<description><![CDATA[Hi Charles
Thank you so much for your exact and useful reply.
That’s interesting about deadlock between nagle’s algorithm and Delay ACK and I think it’s my most important problem but I did not get your mean about “This problem will happen when the ACK frequency is not set the same on the receiving and sending computers”. Why is it important that the ACK frequency should be same in sender and receiver?
 If it’s possible could you explain it
Thanks’
GHASSEM]]></description>
		<content:encoded><![CDATA[<p>Hi Charles<br />
Thank you so much for your exact and useful reply.<br />
That’s interesting about deadlock between nagle’s algorithm and Delay ACK and I think it’s my most important problem but I did not get your mean about “This problem will happen when the ACK frequency is not set the same on the receiving and sending computers”. Why is it important that the ACK frequency should be same in sender and receiver?<br />
 If it’s possible could you explain it<br />
Thanks’<br />
GHASSEM</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Charles Hooper</title>
		<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/#comment-2930</link>
		<dc:creator><![CDATA[Charles Hooper]]></dc:creator>
		<pubDate>Wed, 09 Mar 2011 12:38:17 +0000</pubDate>
		<guid isPermaLink="false">http://hoopercharles.wordpress.com/?p=318#comment-2930</guid>
		<description><![CDATA[Ghassem,

Excellent question, and I had hoped that this article addressed the issue that you mentioned.  I think that my article might be a little confusing because I used the term &quot;optimized&quot; to decribe a situation where a person *thought* that they were improving performance by adjusting the ACK frequency from the default value of 2 to something like 4 or 13 - because that is what some article suggest to change.  The ACK problem can be seen in a couple of the screen captures in this article.  For example this screen capture that shows the default ACK value of 2:
http://hoopercharles.files.wordpress.com/2009/12/fastlanselectncmrpicture.jpg
Compare the above screen capture with this screen capture that shows what happened when the ACK value was set to 13:
http://hoopercharles.files.wordpress.com/2009/12/fastlanselectncmrpicturenagle.jpg

The screen captures show the first 35 packets of the Wireshark capture.  In the picture that shows the capture with the ACK value set at 2, the first packet is seen at 34.097254 and the 35th packet is seen at 34.105656, so the elapsed time is roughly 0.008402 seconds.  In the picture that shows the ACK value set at 13, the first packet is seen at 45.184532 and the 35th packet is seen at 45.591271, so the elapsed time is roughly 0.406739 seconds --- 0.398337 seconds longer than the default ACK value.  Why did this happen?  Go back through the picture that shows the ACK value set at 13 and see where the 0.406739 were lost.  We see a roughly 0.2 second delay between packet 11 and 12, and a roughly 0.2 second delay between packets 22 and 23.  

0.2 seconds is essentially a magic number of sorts - the receiving computer was expecting to receive a total of 13 packets before it had to send back an ACK, there is a 0.2 second maximum timeout before a receiver must send an ACK, and the sending computer halted the transmission of packets before the 13th packet was sent because it had not received confirmation that the previous packets were received correctly.  This problem will happen when the ACK frequency is not set the same on the receiving and sending computers, or in some cases if fewer than the expected packets were transmitted (search for the term Nagle http://www.google.com/search?q=nagle ).]]></description>
		<content:encoded><![CDATA[<p>Ghassem,</p>
<p>Excellent question, and I had hoped that this article addressed the issue that you mentioned.  I think that my article might be a little confusing because I used the term &#8220;optimized&#8221; to decribe a situation where a person *thought* that they were improving performance by adjusting the ACK frequency from the default value of 2 to something like 4 or 13 &#8211; because that is what some article suggest to change.  The ACK problem can be seen in a couple of the screen captures in this article.  For example this screen capture that shows the default ACK value of 2:<br />
<a href="http://hoopercharles.files.wordpress.com/2009/12/fastlanselectncmrpicture.jpg" rel="nofollow">http://hoopercharles.files.wordpress.com/2009/12/fastlanselectncmrpicture.jpg</a><br />
Compare the above screen capture with this screen capture that shows what happened when the ACK value was set to 13:<br />
<a href="http://hoopercharles.files.wordpress.com/2009/12/fastlanselectncmrpicturenagle.jpg" rel="nofollow">http://hoopercharles.files.wordpress.com/2009/12/fastlanselectncmrpicturenagle.jpg</a></p>
<p>The screen captures show the first 35 packets of the Wireshark capture.  In the picture that shows the capture with the ACK value set at 2, the first packet is seen at 34.097254 and the 35th packet is seen at 34.105656, so the elapsed time is roughly 0.008402 seconds.  In the picture that shows the ACK value set at 13, the first packet is seen at 45.184532 and the 35th packet is seen at 45.591271, so the elapsed time is roughly 0.406739 seconds &#8212; 0.398337 seconds longer than the default ACK value.  Why did this happen?  Go back through the picture that shows the ACK value set at 13 and see where the 0.406739 were lost.  We see a roughly 0.2 second delay between packet 11 and 12, and a roughly 0.2 second delay between packets 22 and 23.  </p>
<p>0.2 seconds is essentially a magic number of sorts &#8211; the receiving computer was expecting to receive a total of 13 packets before it had to send back an ACK, there is a 0.2 second maximum timeout before a receiver must send an ACK, and the sending computer halted the transmission of packets before the 13th packet was sent because it had not received confirmation that the previous packets were received correctly.  This problem will happen when the ACK frequency is not set the same on the receiving and sending computers, or in some cases if fewer than the expected packets were transmitted (search for the term Nagle <a href="http://www.google.com/search?q=nagle" rel="nofollow">http://www.google.com/search?q=nagle</a> ).</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: ghassem koolivand</title>
		<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/#comment-2929</link>
		<dc:creator><![CDATA[ghassem koolivand]]></dc:creator>
		<pubDate>Wed, 09 Mar 2011 12:09:19 +0000</pubDate>
		<guid isPermaLink="false">http://hoopercharles.wordpress.com/?p=318#comment-2929</guid>
		<description><![CDATA[Dear Charles
Thank you for this article.It&#039;s very useful.
I have a question about TCP ACK Frequency.I have tried doing all thing that I understand from the article but when I increase TCP ACK Frequency from default value(2) to 4 or 13 my response time increase, although the count of packet decrease.what&#039;s my problem??? why this happen ? 
If needed I can send the Wireshark&#039;s dump to you(if I have your email)

Thank you so much
Ghassem]]></description>
		<content:encoded><![CDATA[<p>Dear Charles<br />
Thank you for this article.It&#8217;s very useful.<br />
I have a question about TCP ACK Frequency.I have tried doing all thing that I understand from the article but when I increase TCP ACK Frequency from default value(2) to 4 or 13 my response time increase, although the count of packet decrease.what&#8217;s my problem??? why this happen ?<br />
If needed I can send the Wireshark&#8217;s dump to you(if I have your email)</p>
<p>Thank you so much<br />
Ghassem</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: OOW10: All Over &#171; ORAganism</title>
		<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/#comment-1891</link>
		<dc:creator><![CDATA[OOW10: All Over &#171; ORAganism]]></dc:creator>
		<pubDate>Mon, 27 Sep 2010 23:01:06 +0000</pubDate>
		<guid isPermaLink="false">http://hoopercharles.wordpress.com/?p=318#comment-1891</guid>
		<description><![CDATA[[...] &#8211; blog post (first of a 7 part series) from Charles [...]]]></description>
		<content:encoded><![CDATA[<p>[...] &#8211; blog post (first of a 7 part series) from Charles [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Blogroll Report 11/12/2009-18/12/2009 &#171; Coskan&#8217;s Approach to Oracle</title>
		<link>http://hoopercharles.wordpress.com/2009/12/15/network-monitoring-experimentations-1/#comment-91</link>
		<dc:creator><![CDATA[Blogroll Report 11/12/2009-18/12/2009 &#171; Coskan&#8217;s Approach to Oracle]]></dc:creator>
		<pubDate>Sat, 02 Jan 2010 17:50:58 +0000</pubDate>
		<guid isPermaLink="false">http://hoopercharles.wordpress.com/?p=318#comment-91</guid>
		<description><![CDATA[[...] to monitor networking of database operations with Wireshark Charles Hooper-Network Monitoring Experimentations 1 Charles Hooper-Network Monitoring Experimentations [...]]]></description>
		<content:encoded><![CDATA[<p>[...] to monitor networking of database operations with Wireshark Charles Hooper-Network Monitoring Experimentations 1 Charles Hooper-Network Monitoring Experimentations [...]</p>
]]></content:encoded>
	</item>
</channel>
</rss>
