[e2e] Data + FIN
richard at starburst.demon.co.uk
Thu Jan 25 20:07:23 PST 2001
> As to *how frequently* it happens, somebody with ready access
> to packet traces can better answer that question. Two years ago,
> Anja Feldman gave me a number that was (I believe) on the order
> of 40% of TCP connection were doing this, based on a packet trace
> from AT&T.
I analysed some sample traces I have from the monthly Netcraft Web Server
Survey, which shows about 80% of FIN segments carry data on connections
transferring over 4096 bytes of data in that direction. But when the
connection carries little data it is dramatically less, about 1.3%
for connections carrying 1024 bytes or less data, eg a HTTP HEAD response.
This fits in well with your suggestion that only when data queues on the
host is the FIN usually piggybacked onto the last data segment. The 80%
result suggests most, if not all, server OSs are capable of piggybacked
FIN onto data segments in some circumstances.
Caveats: my analysis only considers the HTTP response side of each
connection, not the short GET/HEAD request side. The analysis is
of connections to web servers at different IP addresses from a single
FreeBSD RFC1323 enabled client system. But since I only look at the HTTP
response direction, that would be observing TCP from a wide variety of
web servers and OSs.
I looked at the last 10 monthly surveys, >4096 byte transfers varied from
76.9% to 84.1% between months, with no particular trend over time, and
<=1024 byte transfers from varied from 1.0% to 2.0%. The traces analysed
had 47,000 >4096 byte transfers and 445,000 <=1024 byte transfers.
The way the samples are selected isn't properly random, so this
isn't truly representative of public web servers as a whole - but I'd
expect this to be reasonably indicative of higher latency connections.
Low latency connections might behave quite differently of course, as
data might queue less.
Richard Wendland richard at netcraft.com
More information about the end2end-interest