You are not logged in.

#1 2009-10-25 23:16:13

bimbo
Member
Registered: 2005-08-12
Posts: 22

[SOLVED] SLOW web SURFING (tcpdumps attached)

THIS PROBLEM HAS ALREADY BEEN SOLVED, THANKS TO heftig from #archlinux that solved this. The solution was actually pretty simple, set tcp_window_scaling to 0:

echo 0 > /proc/sys/net/ipv4/tcp_window_scaling

This is actually not gnu/linux fault at all. It's my ISP's fault. Here in Mexico, there's a cable company called "MEGACABLE", they seem to hire the system admins that know nothing or little about what they are doing, and this is exactly what caused the problem. The isp runs a transparent proxy (squid), and in the words of heftig this problem reduces to this:

"the issue is their proxy is announcing 'i understand window scaling' even though it doesn't. seems it needs a kernel upgrade"

This one issue is an isolated one, there are other issues regarding the transparent proxy, but I can live with those.

------------------------------------------------------------------------------

Hello, recently I've noticed my web surfing experience under archlinux is extremely slow. First I thought it was a problem with my ISP, but the problem only happened when surfing the web, if I download a file it will download it at the expected rate (5mbit). Other applications work fine (IM, pacman, ping, etc).

The first thing I did was trying with a fresh firefox profile, the problem persisted. Then I tried running it in safe mode, problem still persisted. So I tried a different web browser (konqueror) and the problem was still there. So I discarded this as a browser problem. On this same machine, I ran a virtualized windows instance (virtualbox): web surfing goes many times faster in there (using firefox too).

I manually configured NAT for the virtualized windows machine, so I'm pretty sure all traffic is flowing through my host OS (archlinux). Just to be sure it was not a firewall problem I disabled it, the slow web surfing problem persisted. I don't think this is a DNS issue either, both are using the same dns configuration and doing "nslookup archlinux.org" returns in less than a second (tried that with many other address as well).

So, just to verify what was going on I decided to do a test using tcpdump for webpage http://www.opendns.org (not using it, but this was just for testing). Below are the dumps for both native (archlinux) dump and virtualized (windows) dump. I noticed the archlinux dump shows a really small window size for packets, while the windows machine does not. Also, archlinux receives almost twice as much packets in the process than the windows machine. <-- Already solve this, thanks jargoman.

Additional information:
* there's no web proxy configured for any of the machines (except for the one behind my ISP, but that shouldn't concern me).
* I have changed MTU already (my ISP's dhcp server was setting it to 576, changed it to 1400).
* I did some more tests, sometimes (frequently) I get lots of small Push packets and the web page loads extremely slow, it goes image by image and line by line in paragraphs. Below is a dump that shows this behavior. Notice it took 600 packets to load a single page, it loaded very very slow.

ARCHLINUX DUMP
tcpdump -i eth0 -n tcp and host opendns.com   

16:10:02.395080 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [S], seq 1164693811, win 2144, options [mss 536,sackOK,TS val 13806187 ecr 0,nop,wscale 7], length 0
16:10:02.404975 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [S.], seq 3422882, ack 1164693812, win 8760, options [mss 1460,wscale 0,eol], length 0
16:10:02.405028 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 1, win 17, length 0
16:10:02.405118 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 1, win 17, length 536
16:10:02.405128 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [P.], ack 1, win 17, length 119
16:10:02.592995 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 1, win 46, length 0
16:10:02.593969 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 0
16:10:02.630362 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 329
16:10:02.630396 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 330, win 26, length 0
16:10:02.630929 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.630945 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 866, win 34, length 0
16:10:02.727854 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.727909 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 1402, win 42, length 0
16:10:02.728954 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.729017 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 1402, win 42, length 0
16:10:02.729899 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 536
16:10:02.729964 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 2474, win 51, length 0
16:10:02.823468 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.823524 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 3010, win 59, length 0
16:10:02.826161 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 536
16:10:02.826216 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 3546, win 67, length 0
16:10:02.828020 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.828042 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 3546, win 67, length 0
16:10:02.828807 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.828824 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 4618, win 76, length 0
16:10:02.829747 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.829766 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 5154, win 84, length 0
16:10:02.918759 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.918787 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 5690, win 93, length 0
16:10:02.920392 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.920449 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 6226, win 101, length 0
16:10:02.923307 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 536
16:10:02.923334 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 6226, win 101, length 0
16:10:02.924339 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 536
16:10:02.924356 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 6762, win 109, length 0
16:10:02.926423 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.926441 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 6762, win 109, length 0
16:10:02.927912 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.927927 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 8370, win 118, length 0
16:10:02.928379 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.928398 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 8370, win 118, length 0
16:10:02.929324 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.929347 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 9442, win 126, length 0
16:10:02.930903 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:02.930924 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 9978, win 134, length 0
16:10:03.015360 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:03.015399 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 10514, win 143, length 0
16:10:03.016434 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:03.016496 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 11050, win 151, length 0
16:10:03.017549 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 536
16:10:03.017604 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 11586, win 160, length 0
16:10:03.019564 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:03.019611 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 12122, win 168, length 0
16:10:03.020917 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 501
16:10:03.020936 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 12623, win 176, length 0
16:10:03.022810 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:03.022830 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 12623, win 176, length 0
16:10:03.024203 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 656, win 54, length 536
16:10:03.024218 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 13695, win 185, length 0
16:10:03.024931 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 210
16:10:03.024948 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 13905, win 193, length 0
16:10:03.025535 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [P.], ack 656, win 54, length 7
16:10:03.025553 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [.], ack 13912, win 193, length 0
16:10:03.025565 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [F.], seq 13912, ack 656, win 54, length 0
16:10:03.025685 IP 10.110.81.195.37877 > 208.69.38.150.80: Flags [F.], seq 656, ack 13913, win 193, length 0
16:10:03.123024 IP 208.69.38.150.80 > 10.110.81.195.37877: Flags [.], ack 657, win 54, length 0
16:10:04.683194 IP 10.110.81.195.37884 > 208.69.38.150.80: Flags [S], seq 1201807023, win 2144, options [mss 536,sackOK,TS val 13806874 ecr 0,nop,wscale 7], length 0
16:10:04.692852 IP 208.69.38.150.80 > 10.110.81.195.37884: Flags [S.], seq 26796320, ack 1201807024, win 8760, options [mss 1460,wscale 0,eol], length 0
16:10:04.692919 IP 10.110.81.195.37884 > 208.69.38.150.80: Flags [.], ack 1, win 17, length 0
16:10:04.692994 IP 10.110.81.195.37884 > 208.69.38.150.80: Flags [.], ack 1, win 17, length 536
16:10:04.693004 IP 10.110.81.195.37884 > 208.69.38.150.80: Flags [P.], ack 1, win 17, length 224
16:10:04.706404 IP 208.69.38.150.80 > 10.110.81.195.37884: Flags [.], ack 537, win 32696, length 0
16:10:04.706452 IP 208.69.38.150.80 > 10.110.81.195.37884: Flags [.], ack 761, win 32584, length 0
16:10:04.908541 IP 208.69.38.150.80 > 10.110.81.195.37884: Flags [.], ack 761, win 32964, length 536
16:10:04.908584 IP 10.110.81.195.37884 > 208.69.38.150.80: Flags [.], ack 537, win 26, length 0
16:10:04.909880 IP 208.69.38.150.80 > 10.110.81.195.37884: Flags [P.], ack 761, win 32964, length 286
16:10:04.909917 IP 10.110.81.195.37884 > 208.69.38.150.80: Flags [.], ack 823, win 34, length 0
WINDOWS DUMP
tcpdump -i eth0 -n tcp and host opendns.com

16:09:42.130172 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 9975834, win 64240, length 536
16:09:42.130216 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [P.], ack 1, win 64240, length 133
16:09:42.335734 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 0, win 5840, length 0
16:09:42.335774 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 0
16:09:42.404828 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [P.], ack 669, win 6432, length 329
16:09:42.405647 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.406125 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 1710, win 64240, length 0
16:09:42.508888 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.509202 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 1710, win 64240, length 0
16:09:42.511601 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.512218 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 4470, win 64240, length 0
16:09:42.514308 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.514994 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 5850, win 64240, length 0
16:09:42.608441 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.611712 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.614715 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 7230, win 64240, length 0
16:09:42.616634 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.617770 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 9990, win 64240, length 0
16:09:42.619459 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 669, win 6432, length 1380
16:09:42.620802 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 11370, win 64240, length 0
16:09:42.622500 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [P.], ack 669, win 6432, length 1253
16:09:42.711272 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [P.], ack 669, win 6432, length 7
16:09:42.711735 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 12623, win 64240, length 0
16:09:42.711757 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [P.], ack 669, win 6432, length 1282
16:09:42.712316 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 13912, win 64240, length 0
16:09:42.712351 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [F.], seq 669, ack 13912, win 64240, length 0
16:09:42.713234 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [F.], seq 13912, ack 669, win 6432, length 0
16:09:42.714178 IP 10.110.81.195.1583 > 208.69.38.150.80: Flags [.], ack 13913, win 64240, length 0
16:09:42.819594 IP 208.69.38.150.80 > 10.110.81.195.1583: Flags [.], ack 670, win 6432, length 0
16:09:43.752660 IP 10.110.81.195.1585 > 208.69.38.150.80: Flags [S], seq 1619761946, win 64240, options [mss 1460,nop,nop,sackOK], length 0
16:09:43.802954 IP 208.69.38.150.80 > 10.110.81.195.1585: Flags [S.], seq 12220252, ack 1619761947, win 8760, options [mss 1460,eol], length 0
16:09:43.803630 IP 10.110.81.195.1585 > 208.69.38.150.80: Flags [.], ack 1, win 64240, length 0
16:09:43.803662 IP 10.110.81.195.1585 > 208.69.38.150.80: Flags [.], ack 1, win 64240, length 536
16:09:43.803677 IP 10.110.81.195.1585 > 208.69.38.150.80: Flags [P.], ack 1, win 64240, length 237
16:09:43.814162 IP 208.69.38.150.80 > 10.110.81.195.1585: Flags [.], ack 537, win 65164, length 0
16:09:43.814258 IP 208.69.38.150.80 > 10.110.81.195.1585: Flags [.], ack 774, win 64927, length 0
16:09:44.017480 IP 208.69.38.150.80 > 10.110.81.195.1585: Flags [P.], ack 774, win 65535, length 823
16:09:44.186029 IP 10.110.81.195.1585 > 208.69.38.150.80: Flags [.], ack 824, win 64240, length 0
ULTRA SLOW ARCHLINUX DUMP (this is from just one request!)
tcpdump -i eth0 -n tcp and host opendns.com

http://pastebin.com/m15ee1831

What's going on here? I'm really lost. I'll really appreciate all the help you can give.
Edgar Merino

Last edited by bimbo (2015-07-24 04:15:06)

Offline

#2 2009-10-26 02:39:08

jargoman
Member
Registered: 2008-03-10
Posts: 33

Re: [SOLVED] SLOW web SURFING (tcpdumps attached)

if you search Maximum Transmission Unit it's a setting in routers and can be set in windows/linux. It's the default size of a tpc packet. Or the maximum a tcp packet can be. If you can set the mtu in arch as much the windows maybe it will help. I don't really know how to do that but by looking at your tcpdump I'd say the windows mtu is 1380 and arch's is 536. Arch would need about 2.5 more packets per transmission. I think routers are set to 1400 - 1440 or so setting it above 1400 is a probably a bad idea.

Offline

#3 2009-10-26 03:12:06

bimbo
Member
Registered: 2005-08-12
Posts: 22

Re: [SOLVED] SLOW web SURFING (tcpdumps attached)

-

Last edited by bimbo (2009-10-26 22:45:52)

Offline

#4 2009-10-26 11:37:01

VirtualRider
Member
Registered: 2008-08-20
Posts: 134

Re: [SOLVED] SLOW web SURFING (tcpdumps attached)

I have a feeling of "slow internet" too. I could improve it a little by disabling IPv6 and using dnsmasq as local dns-cache. But i still see, that in firefox when a page takes a while for loading, all other tabs will be blocked until the first operation is done. I never could figure out how to solve that.

Offline

Board footer

Powered by FluxBB