Slow file transfer and TCP Zero Window Probe

Slow file transfers must be really bothering everyone. I have a ZyXEL NSA325 NAS device which has a gigabit interface but I am getting extremely low throughput. Unfortunately this has been a problem I think since I bought this device. Now I could finally get hold of time to troubleshoot the issue. Here is my topology I used in testing this scenario.


As per the topology above, my laptop and this NAS device are connected to two ports of this Juniper EX2200 switch. I have enabled jumbo frame on the ports, laptop and NAS device.

root@ex2200-1# set interfaces ge-0/0/10 mtu 9216
root@ex2200-1# set interfaces ge-0/0/8 mtu 9216

This change was actually ineffectual but I just wanted to test.

To cross out any other parameters, I have just started a file transfer via plain FTP and throughput fluctuated from 6MB/s to 14MB/s which is way low from this directly connected gigabit link and when you open the wireshark capture you see this:


NAS device ( sends a TCP segment towards the client with a Window Size of 0. It literally means “stop sending any more data to me buddy”. This is really bad. It is just a single ftp file transfer on a local gigabit link but what happens after this?


Very quickly after Zero Window response, client probes the remote device by sending a 1 byte FTP payload [ZeroWindowProbe] but the response (packet #78456) contains another TCP segment with Window Size of 0 which is interpreted by Wireshark as [ZeroWindowProbeAck] i.e server doesn’t really increase the window size. This continues until packet #78462 in which you see that Window is now 55296 and Wireshark interprets this as an [TCP Window Update] i.e an increment from 0 to 55296.

Bad news is that this keeps repeating itself with no improvements on the throughput:-(

Unfortunately this device has serious issues either some hardware or application related but I have got a lesson. If you buy a device, test it as soon as possible and return it if country of your residence has good return policy.

For TCP window probes you can check RFC793 and RFC1112.

About: rtoodtoo

Worked for more than 10 years as a Network/Support Engineer and also interested in Python, Linux, Security and SD-WAN // JNCIE-SEC #223 / RHCE / PCNSE

2 thoughts on “Slow file transfer and TCP Zero Window Probe”

    1. Thank you for the recommendation Mohamed. Next time, I will try it but with an acceptance test:-)

You have a feedback?

Discover more from

Subscribe now to keep reading and get access to the full archive.

Continue reading