Network: The relationship between TCPWindowSize and DefaultReceiveWindow

We threw this question to our MS premier techie as we were troubleshooting some related issues and I thought his reply would be helpful for some of you out there.

Q1: What’s the relationship between the TCPWindowSize setting and the DefaultReceiveWindow handled by AFD.sys?

TCPWindowSize defines the amount of receive data (in bytes) that can be buffered during a connection at TCP/IP layer. The sending host can send only that amount of data before it must wait for an acknowledgment and window update from the receiving host. Windows will self-tune the TCP window size if it’s not explicitly defined in registry.

DefaultReceiveWindow defines the default receive buffer in Socket layer. By default, it’s 8 KB. Programs based on Socket gets data from that buffer. When a program receives more data than this buffer is configured to hold, all data received up to this count must be transferred to the program before receiving continues. When this happens, an acknowledgement will be sent to the source machine.

For example, if the application wants to read 32KB from the socket, it actually reads it from the buffer for 4 times (32/8 = 4).

Looking at active ports in Windows

Windows OS provides netstats which provides you some information on who is connected to your TCP or UDP ports and which port is active. However, very often when a service could not start because of port conflicts, that is, some other service is using the same port, netstats does not help you in your troubleshooting.

2 freeware available in the net allows you to view active port connections and which exe are running them.

- TCPView
- Aports