TCP Analysis
If any part of your system uses TCP—control channels, file transfers, some streaming protocols—you need to understand how TCP's congestion control affects timing. A "working" TCP connection can still introduce hundreds of milliseconds of latency under the wrong conditions.
The TCP RTT and TCP Window charts show what TCP is actually doing, not just whether packets are flowing.
TCP Round-Trip Time
Shows round-trip time (RTT) for TCP flows over time. RTT is measured using TCP sequence numbers and acknowledgements. Each flow uses the same color as in the Top Talkers chart.
Connection State Markers:
| Marker | Meaning |
|---|---|
| ▶ New | New TCP connection (SYN handshake observed) |
| ‖ Half-closed | FIN seen in one direction (data may still flow) |
| ■ Closed | TCP connection fully terminated (FIN in both directions, or RST) |
Gaps in the line indicate idle periods where no RTT samples were collected.
TCP Advertised Window
Shows the TCP advertised window (receive window) for each flow over time. The advertised window indicates how much data the receiver is willing to accept.
Event Markers:
| Marker | Meaning |
|---|---|
| ⚠ Zero Window | Receiver advertised zero window (flow control pause) |
| ↻ Dup ACK | Duplicate acknowledgement (possible packet loss) |
| ↩ Retransmit | Retransmitted segment detected |
| ▼ ECE | ECN-Echo flag set (explicit congestion notification) |
| ▲ CWR | Congestion Window Reduced flag set |
Note: A dotted line indicates the SYN handshake was not captured, so the window scale factor is unknown. The displayed values may be smaller than actual — modern TCP typically uses scale factors of 7-8, meaning actual windows are 128-256× larger than shown.
What These Charts Reveal
- Bufferbloat — RTT spikes dramatically under load
- Receive Window Starvation — Window drops to zero, causing stalls
- Retransmission Storms — Frequent retransmit markers indicate packet loss
- Congestion — ECE/CWR markers show explicit congestion notification in use