TCP Congestion Control // Hands-On Deep Dive TCP Analysis with Wireshark

[@alikhalidsalim4865]

Thank you Chris. Waiting for more and more content on TCP, QUIC & TLS .. Big big big thanks to you ❤️❤️

[@ChrisGreer]

Working on more as we speak! thank you for watching and commenting.

[@ranjanadissanayaka5390]

Hi Chris.. you did an amazing job explaining congestion control. I watched a lot of your TCP videos. You did an amazing job making me a understand TCP throughout this playlist. Thank you so much. 😀

[@jundbaba1]

Amazing , I had written SLOW-START, CONGESTION AVOIDANCE and FAST-RETRANSMIT in my notes, but never understood those. Thanks to Chris I am in better postiion for my upcoming job interview.

[@ChrisGreer]

Awesome! Glad the video helped you!

[@arkadybron1994]

Clear, concise, articulate explanations. Very nicely done squire.

[@mohkamal]

I want to say that your channel and content is one of the best I could see related to the TCP, keep going please! Thank you!

[@ChrisGreer]

Thank you for the comment! I appreciate the positive feedback.

[@masudimtiaz2325]

These are excellent contents, Chris. I'd like to know more about TCP Optimization.

[@MrRobot222]

Came over from David Bombal's channel and so pleased I did! 😊

[@ChrisGreer]

Welcome Alex!

[@LilleFjert]

Very good explanation of this topic. Think I finally got it. A very important point you make is that not all TCP stacks handle this the same / as aggressive.

[@ChrisGreer]

Great to have you! Yeah congestion control is a tough thing to get straight.

[@loveplanes]

You can't imagine how much you have helped me. Thanks a lot

[@ChrisGreer]

Happy to help!

[@shubhankark_007]

This is good stuff and explained in easy way. I have been following your session since I have attended one of you session in Shark Fest. You really know how to simplify the complex concepts and explain it to larger audience.

[@ChrisGreer]

thank you for the comment!

[@remixesanddownpitches6141]

you explain this so well. i am so grateful for you and this channel

[@lenyfreeman3807]

I'm so impressed, I bought the T-Shirt!!

[@DX-qe5yh]

dude thanks, best explanation on congestion window I've seen so far!

[@ChrisGreer]

Thanks for the comment!

[@colinrogers9927]

This is a very good explanation. I deal with this every day and you nailed it. Great work

[@ChrisGreer]

Wow thanks for the comment Colin!

[@aarni.d.j]

Thank you so much Dear Chris, You are such a Good Mentor.

[@dfunnypetsshorts2251]

Really great..Hope you do more tcp congestion analysis. Thanks!

[@ChrisGreer]

I love that stuff. Good idea!

[@letsgopacket4419]

Great video Chris!! waiting for your deep dive in SACK explanation

[@ChrisGreer]

You got it!

[@jonathantx]

Awesome explanation 🤯. Thank you very much for making this material available and please keep making more.

[@ChrisGreer]

Thank you! Will do!

[@MegaDiamond91]

God bless this awesome guy and prevent any mess in sequence numbers. :)

[@freddrune8315]

Outstanding performance. Could you please add more security materials.

[@ChrisGreer]

Definitely!

[@toms9630]

Great content in all your TCP videos - very informative, clear, concise and professionally presented. Haven't seen one yet that wasn't excellent. Thanks for your generous contributions. In your presentation, the iperf implements congestion control with the Initial Window of 8 and increases CWND by 2 segments each round trip but could double it each RTT as you point out. But RFC 5681 states that the upper bound of the IW MUST be set to no more than 2, 3 or 4 segments depending on the value of MSS. It also states that "During Slow-Start, a TCP increments cwnd by at most SMSS bytes for each ACK received that cumulatively acknowledges new data.", which as written means by one segment per round trip unless it meant to say "by at most SMSS * the cumulative ACK count". Could upi resolve the confusion regarding IW and the CWND increase? Thanks Much!

[@Network-Mike]

Just found your channel, love all your videos! Thanks for sharing your vast knowledge.

[@ChrisGreer]

Glad you stopped by Mike!

[@DanielOliveira-fq1ge]

Good illustrative example and explanation. Thank you!

[@krishangopal4156]

Ohhhh .. you made my day. Explaining this congestion window...

[@ChrisGreer]

Yikes, yeah it's a tough one to understand. I'm glad it helped!

[@DevOpsLabs4Me]

I know i'm late to the party, but thanks for another gem.

[@rajindersinghbargari9936]

Always love your videos, thank you for making difficult things easy

[@ChrisGreer]

Thanks for the comment!

[@aswinnair101]

Thank you for the awesome explanation. Loving all the TCP content!

[@ChrisGreer]

Thank you for the comment!

[@sampathkumaradepu1811]

Hi Chris. U explain it with so ease, thanks for that. I am newbie in networking field and one of my mentor told me to practise tcp/ip protocols with wireshark. I was searching for videos and stumbled upon ur channel. Can u pls guide me how to start for a beginner. I am focusing my career on testing and automation. Pls help me.

[@ChrisGreer]

That is great to hear. Have you checked out my wireshark course - www.bit.ly/wiresharkintro It is a good overview of wireshark

[@paherbst524]

Thanks for taking time to deep dive into these things.

[@ChrisGreer]

My pleasure!

[@domagoj19zg]

..as always Chris, thank you for wireshark content!

[@ChrisGreer]

You bet! Glad it helps.

[@kirannolan]

your videos are awesome sir

[@ChrisGreer]

Thanks for watching and commenting!

[@pelpetia]

You are good at this dude! Thanks so much

[@Hypocrisy.Allergic]

Exceptional explanations. ❤️

[@benjaminwharton6264]

Chris, I am going to drop out of college and watch your videos instead. Thank you so much for creating this content.

[@ChrisGreer]

Haha! Please don’t drop out for my content! 😜 honestly just keep analyzing traffic no matter what and you will have a bright future in this field, college or not.

[@mayurhabbu7361]

Thank you Chris !! Great content ..My concepts got cleared

[@karifkhan]

Thank you Chris, nicely explained.

[@govindpandit2017]

lovely explanation 🔥❤️

[@MrBitviper]

thank you for the brilliant explanation chris.. much appreciated

[@ChrisGreer]

My pleasure!

[@techorg21]

Hi, I really loved your video can you pick a pcap for IMSI from a telecom node and explain how the handshake is happening with the server and why sometimes IMSI can not access the server in ipv6 mode.

[@ChrisGreer]

Thanks for the comment. I haven't seen a pcap like that yet. If you have one let me know and I could feature it.

[@punkplino]

Great video. It was straight yo the vein!!

[@ChrisGreer]

Glad you liked it!

[@shreyatawde5806]

Thanks a lot for this Chris. I am able to troubleshoot a lot better because of the knowledge shared in your videos. You are the best Keep it coming.

[@ChrisGreer]

Thanks for the comment!

[@haasjenl9247]

Thx for the content! Learning a lot from your packet analysis.

[@ChrisGreer]

Glad to hear it!

[@charleyshiman4748]

Cool chammel. Thank you for what youre doing

[@ChrisGreer]

Thanks for the comment!

[@mcgirishnetwork]

Very informative video. Thank you Chris.

[@ChrisGreer]

Glad you enjoyed it!

[@sizhuangliang9118]

This is really great! Thank you!

[@ChrisGreer]

You're very welcome!

[@wiresharkmania709]

Hello Chris, Thanks for this new usefull video. What's the difference(s) between the congestion window and the sliding window as both are maintained by the sender ? BR

[@ChrisGreer]

Hey thanks for the comment! They are very closely related concepts so it's easy to mix them up. Here is an awesome article about sliding windows that should help - www.extrahop.com/company/blog/2017/tcp-windowing/

[@kosmonautofficial296]

Great video Chris! At 11:20 when we lost data, how would we go about finding out where in the network this was? Could this be something a show command on a cisco device could help find in the path where something was lost? or would you go about determining this from running more pcaps across the path? Sometimes when I am troubleshooting I have access to some network devices in the path but usually closer to clients but not servers.

[@brandonbarrington6533]

Great as always Chris!

[@ChrisGreer]

Glad you enjoyed it!

[@learnerforlife1338]

Great video. Thankyou. Subscribing right away !

[@yohanmeier6061]

Thank you for share, always top

[@ChrisGreer]

Thanks for the comment Yohan!

[@arsbsuir]

Thank you for the video. The question I have is What makes .196 to ack only after 8/10/12... segments. In other words what determines how many segments the receiving party acknowledges receiving? Why don't we see more acks there? Does it have to do with Delayed ACK mechanism? If so, why the number (in ms) is fluctuating?

[@ChrisGreer]

Hey! Great question. In short, kinda. ACK frequency is usually dependent on the stack settings and how sensitive it is to incoming data. In this case we do see the receiver delaying the ack for several large ingress MSS's, but it is not time based. We can see that the receiver is striking a balance - ACKing quickly, but not every other packet which isn't really necessary in this case. I've seen this behavior with throughput tests like these where a large amount of data quickly arrives at the receiver.

[@arsbsuir]

@@ChrisGreer Thanks, I appreciate your answer.

[@TNothingFree]

Reading the RFC alone may be confusing, your videos are making things very clear, Gj! In your experience, does increasing initial MSS value to an extremes value like 64 causes more issues?

[@ChrisGreer]

I would say so because that is a super small MSS! Are you thinking of the initial window? I haven't ever increased it that much manually. I'm sure the super-smart people who designed the TCP stack did though....

[@TNothingFree]

​@@ChrisGreer Yeah the value which defines the initial window size. I performed performance tests over TCP to boost performance over lines with latencies and 100-1000 MBPS. ("Fat long pipes") Before sending app data which is very consuming (MB-GB of data), it sends few MBs (1-10). I found that with latency it took x3 times as much because of the slow start. So I boosted it up to 64 initial MSS and got the best result because it no longer slow started. [Was very visible in the Wireshark also thanks for your videos :) ]

[@noasimhon9903]

Amazing video!

[@ChrisGreer]

Thanks!

[@jjames7206]

Thanks Chris! I still have a question for receive window, what and how decide size of receive window? code of program or something else?

[@ChrisGreer]

The TCP stack itself usually has a default window size option that is used. However it is possible for an application to override this option with a different value.

[@gofai2003]

Thank you Chris

[@ChrisGreer]

Very welcome!

[@nathansherrard4111]

Hey Chris, this is really great stuff - just found you channel! Had a question/confirmation: The [TCP Fast Retransmission] goes out in #3361 in response to 3 DUP ACK's. Then in #3388, after another 27 DUP ACK"s come in, we see a [TCP Out-of-Order] go out. I assume #3388 was in response to the SACK Left Edge indicating 2 segments were missing, and thus it was re-sending that second one (first obviously going out from that [TCP Fast RT] ), and that the 20ms gap was just due to the calculating/processing of that SACK data? Interestingly, there's only < 1 ms delay between getting the ACK for first missing segment (#3503) and the ACK for second missing segment (#3505, which also got everything caught up) - presumably the other side was piecing some things back together and then shot out both ACK's back to back despite them coming in 20ms apart?

[@ChrisGreer]

Hey Nathan, nice job! Great analysis and great question. Without having a pcap on the other side, we can't be 100% sure, but we definitely can measure that 20mSec delta between the RT and the Out-of-order (which is also technically a retransmission but the wireshark TCP analysis bits can sometimes get that confused). Based on the behavior, I would say that there are a two possiblities 1. Like you mentioned, the server could have halted 20msec in transmitting the second retrans. 2. The network could have buffered it along the path. I say that because we already see high latency and congestion-induced loss on this network. So it's possible it got stuck in a buffer for a few ms en route. Either way - great spot and thank you for the comment! This is definitely a case-in-point of why i ask my clients for dual-side captures when I am doing deep TCP analysis. Takes the guessing out of the way. Keep on capturing Nathan!

[@malkeetkalera7520]

Hi Sir you are great 👍 uer video very help us

[@ChrisGreer]

Thanks and welcome!

[@PKJamal-b5q]

Thanks

[@rajcomeng]

Thanks a lot

[@ChrisGreer]

Most welcome!

[@magawla]

Superb!

[@ChrisGreer]

Thanks a lot!

[@NockerlHusten]

Great Video thx.

[@anachronic-vibes]

Mulțumim!

[@ChrisGreer]

Thank you!

[@jonathan2260]

Hello Chris. Loving the content. I was trying to look at the file but I cannot reproduce the column TCP segment. I found what seemed to be the MMS Value location under TCP Options - Maximum segement size but it does not show the same results as what you display on your screen. Can you point to how that column is created? Thanks.

[@ChrisGreer]

Look above the "Sequence Number" field in the TCP header. You should see TCP Segment Length. That is the one you want to add as a column. Right click - Apply As Column.

[@jonathan2260]

@@ChrisGreer Found it. Thank you.

[@marcellogambetti9458]

which CCA are you using in the example lab ? because i have different results with mine, using cubic. thank you!

[@ChrisGreer]

Gotta check, but I am pretty sure it was cubic as well.

[@sukshithshetty8349]

Tilll when will the congestion window keep doubling ? How to find the threshold?

[@ChrisGreer]

It will usually go up quickly until it reaches to ssthresh value (slow start threshold) which is an internal value in the stack.

[@richardscheffenegger9138]

What odd stacks have created the trace in this example? Ack compression/thinning like this by the receiver is by itself a massive performance restriction? That the cwnd collapses down to 4 MSS instead of 50% (newreno) or 70% (cubic) is also very curious - I'm inclined to suspect this is an artificially created trace with dummynet (100ms delay) and some time-based ACK thinning...

[@ChrisGreer]

Good spot @richardscheffenegger9138 - this trace was created using iPerf. I tweaked a few of the window size settings so it would be easier to see the collapse of the congestion window. When you are teaching cwin, doing so in a real, uncontrolled environment is very tricky. Not the best way to introduce new learners to the concept.

[@richardscheffenegger9138]

@@ChrisGreer Sure. I meant which OS (& version) this was captured on. Linux is supposed to infer the slow-start phase and ACK every segemnt then (non-RFC behavior). TSO/LRO/GRO can interfere and create this extreme ACK thinning you showed. So for a clean (textbook) example, disabling TSO/GRO and clearing the HostCache are key. For the highest alignment of the TCP implementation with the RFCs, you may want to use FreeBSD or another BSD variant. If you want to show some fancy effects like continous cwnd growth while the application limits its sending speed, and then provides a huge chunk of data, you want to use uperf. That could demonstrate what happens After Idle, or when the cwnd is kept open, with little data transfern, until a massive burst of data is provided - line rate jump in the TCP sending rate, usually massive induced losses in the Tail-Drop queues, and even lost retransmissions (which again Linux does a very good job handling, even while RFCs are silent on that). You may want to look into RACK/TLP (Netflix traffic) though, since the loss recovery there is quite outstanding. And as I mentioned elsewhere, a good demonstation of the TCP ECN control loop is no where to be found, even though many large players (MSFT, Apple, ...) have started deploying ECN since a few years. (Also check DCTCP). If you want more details, contact me ;)

[@ChrisGreer]

@@richardscheffenegger9138 As I recall this was between a Win11 and Mac 11.1.x or something like that. A lot of what you are describing is far beyond the intent of this video and even beyond the interest of the standard KZbin viewer. Good fodder for a TCP Congestion course though.

[@nikosg6]

Hi! "The initial value of ssthresh SHOULD be set arbitrarily high (e.g., to the size of the largest possible advertised window)" (rfc5681), as i understand it, that means Window Scale * Window = 262140 bytes, so why slow start threshold is 32 (46720 bytes)? (time = 07:14) " If (SMSS > 1095 bytes) and (SMSS

[@ChrisGreer]

Hey great comment. That is because not all OS’s and applications tweak according to the RFC. iPerf is especially picky about it. SHOULD is always a fun word to navigate.

[@richardscheffenegger9138]

Nowadays, IW is up to 10; and frequently tunable (as root) - RFC 6928. Also, virtually all full-feature stacks cache some path information between subsequent sessions - to not overshoot with slow-start the (previously recorded) capabilities of the network (Host Cache). During slow start, ABC (appropriate byte counting) - RFC3465 - is in common use, since delayed ACKs (with an extreme example in the shown trace - more likely ACK thinning going on by the network, or ACK compression due to receiver side LRO, but less likely based on the involved timings - allows for a growth of up to 2 MSS per ACK, if that ACK covers 2*MSS or more - this is to address ACK splitting attacks, where a receiver once could drive the sender to ramp up slow start extremely quickly, locally (close to the server) resulting in massive congestion and an effective DoS attack variant. I would really like to see real advanced topics - such as Timestamps for troubleshooting, how to spot common signatures of TSO, LRO, ACK compression, ACK thinning, HyStart [++], SACK+RTO, Lost Retransmission (Detection), ECN (AccECN), PRR, Rescue Retransmission, TLP, RACK, BBR and what may be typical misbehaviors associated there would be.

[@tylersockington]

Hey there! Hopefully someone can help me out on this one. I'm currently learning how TCP works and I have a question related to this capture: why does .196's Seq number not increase each time it sends an ACK packet to .184? I understand it isn't sending any large amount of data, but is not the ACK packet itself still counted as 1byte and, therefore, would increase the Seq number by 1?

[@ChrisGreer]

Hello! That is a great question. So an ACK carries no data and does not have the SYN or FIN bit set, both of which will increase the seq number by one (the ghost byte). So in this case, .196 is not sending any data, so there is no need to move the seq number forward in that direction. Hope that helps!

[@tylersockington]

@@ChrisGreer thank you!

[@anubhavkumar2059]

Thank you Chris. Can you help me with below issue ? I am stuck with a issue observed in wireshark where I can see that after the complete handshare between server and client is over and the application data is transfered between the server and cllient. After sometime the server sends an encryption alert message with Alert code 21 followed by a FIN signal. The client ACK's the signal and sends its own Encryption alert message with Aler code 21 along with a FIN signal which is ACK's by server. But along with this client also sends a RST signal. I am not understanding why the client is sending an RST signal ? And this issue is happening after every disconnect of the client and server. The server has a keep alive of 6 seconds implemented becuse of which if there is no data to be transfered for 6 seconds the server sends an encryption alert message along with FIN signal.

[@ChrisGreer]

Without the packets it's tough to say for sure. But I am guessing that the server is timing out the encrypted session first, and the client is just reacting. After the FIN that the client sends, it considers anything other than the ACK to that FIN to be further activity, and it will reset. It could be just how the client's TCP stack settings are configured. Unless it is actually breaking anything with the application, you should be able to ignore it. It's just ending the connection with a reset.

[@anubhavkumar2059]

Thanks for the initial analysis Chris. I have the wireshark captures with me. Can I mail you the those ? Would you help me with the further analysis ?

[@richardscheffenegger9138]

@@anubhavkumar2059 the RST may only a courtesy notificiation to the server, to quickly move on from the TIME-WAIT state, releasing some still held resources on the server side... Allowing for a quick recycling of the 4-tuple for a new session (some OS don't have too much leeway in their ephemerial port selections, and re-using the same one in quick succession could otherwise result in a very delayed reconnection time...

[@ArtyJames]

It's not actually looking for a "successful ACK". It's timing the round trip time (RTT) to receive the ack. If you're on a really slow link (think the old modem days) you can't just send 100K bytes or it will take too long to get the handshake. So as long as the acks are received in an acceptable time it can send a larger payload. if you're on a wireless network and there are a bunch of people sharing the "wire", you don't want 1 app dominating the queues for too long.

[@ChrisGreer]

You seem to enjoy these “clarifications”. Could you please post a like to your channel? Might be a better way to go.

[@ArtyJames]

@@ChrisGreer I find it amusing that someone who clearly doesn't understand network protocols in any sort of comprehensive way has a "channel". The modern one-eyed man in the land of the blind. Good for you.

[@ChrisGreer]

It’s ok if you are afraid of creating your own channel and posting content. I really did feel like that for a long time. I felt like I had nothing to share. I felt like everyone would hate my content, think I was stupid, would over criticize the smallest detail. It’s normal. I’m so blessed to have experienced the kindness and good will of the overwhelming majority. You will too. Give it a try. I’ll be happy to reference your stuff!

[@ArtyJames]

@@ChrisGreer Right. The guy who reads stuff off a wireshark display without knowing what he's talking about is brave and I'm afraid.

[@samitpiku]

i dont see the file in github!

[@samitpiku]

Got it! One of the best , probably the best video on tcp packet congestion

[@mayank265memories]

Wireshark says pcap damaged.

[@calebpurvis6195]

Ever seen ESP packet spam from an iPhone shut down a network? Talking multiple GB/min. (Non malicious and not isolated to a single device.) I have capture files if you want to see them. Lol

[@ChrisGreer]

I haven't seen that! Sounds interesting though....

[@haasjenl9247]

@@ChrisGreer i am smelling some new content! :D