You see TCP ZeroWindow in a capture. What does it mean and whose fault is it?
Show the answer
Say this first
The receiver advertised a window of zero: its receive buffer is full because its application is not reading fast enough. The sender stops, starts the persist timer and sends small zero-window probes until the receiver advertises space again with a window update. It points at the receiving host or its application (CPU, disk, a slow consumer), not at the network.
Go deeper
Wireshark labels and who sends them
| Label | Sent by | Meaning |
|---|---|---|
| TCP Window Full | Sender | It has sent everything the receiver's window allows |
| TCP ZeroWindow | Receiver | Window field is 0 |
| TCP ZeroWindowProbe | Sender | Persist timer probe |
| TCP ZeroWindowProbeAck | Receiver | Answer, usually still 0 |
| TCP Window Update | Receiver | Window opened again |
Proving it on the hosts
- Receiver:
ss -tnshows a large Recv-Q on that connection: data the kernel holds that the application has not read. - Sender:
ss -tnshows a large Send-Q: data waiting for window.
Why the persist timer exists
If the receiver's window update were lost, both sides would wait forever. The sender's probes force a fresh ACK carrying the current window.
Silly window syndrome
A receiver that advertises every few freed bytes makes the sender send tiny segments. Receivers wait until they can open a meaningful amount (an MSS or half the buffer) before advertising.
They will ask next
How is "Window Full" different from "ZeroWindow"?
Window Full is the sender using all the window it was given, which can be normal at high speed with a small window. ZeroWindow is the receiver saying it has no space at all.
The network team gets blamed for a slow file copy and the capture is full of ZeroWindow. What do you say?
The network delivered data faster than the receiving application consumed it. Look at the receiver's disk, CPU and application, and show the Recv-Q from
ssas evidence.
Traps
- Treating ZeroWindow as packet loss or congestion. It is flow control doing its job.