Windows scaling heuristics что это

The command netsh interface tcp is used in the Windows Command Prompt (cmd) or PowerShell to enter a specific context within the netsh (Network Shell) utility.

The netsh interface tcp command in Windows is used to configure TCP settings for network interfaces. It allows you to view or modify TCP parameters, such as congestion control, window scaling, and other performance-related settings.

Enters the TCP/IP Interface Context: Running netsh interface tcp by itself doesn’t perform an action like showing or changing settings. Instead, it changes the prompt within netsh to netsh interface tcp>, indicating you are now focused on commands related to the TCP protocol settings for network interfaces.

Here are some common subcommands and their uses:

1. show global:
   • Purpose: Displays the main, system-wide TCP configuration parameters.
   • Example: netsh interface tcp show global
   • Output includes settings like Receive Window Auto-Tuning Level, Congestion Control Provider, and ECN Capability.
2. show heuristics:
   • Purpose: Shows the status of Windows TCP heuristics.
   • Details: Heuristics are adaptive behaviors. This command typically shows whether Window Scaling heuristics are enabled, which allows Windows to automatically adjust TCP window scaling based on network conditions, potentially disabling it if it detects problematic network devices that don’t support scaling correctly.
   • Example: netsh interface tcp show heuristics
3. set global: Modifies global TCP settings.
   • Example: netsh interface tcp set global autotuninglevel=normal
   • Options for autotuninglevel: disabled, highlyrestricted, restricted, normal, experimental.
4. show rscstats:
   • Purpose: Displays statistics related to Receive Segment Coalescing (RSC).
   • Details: RSC is a feature where the network adapter combines multiple received TCP segments into a single larger segment before passing it up the network stack, reducing CPU overhead. This command shows statistics like the number of packets coalesced and saved, but only for network interfaces that support and have RSC enabled.
5. show security:
   • Purpose: Displays TCP parameters related to security.
   • Details: This might show settings configured to mitigate certain types of network attacks, such as SYN flood attacks (e.g., related to SYN Attack Protection features). The specific parameters shown can vary depending on the Windows version.
6. show supplemental:
   • Purpose: Shows parameters related to supplemental TCP templates.
   • Details: Windows allows defining custom TCP settings (like specific congestion control algorithms, initial RTO, etc.) through templates. These templates can then be applied to specific traffic based on ports or subnets (using the Transport Filter Platform). This command displays the parameters configured in these supplemental templates.
   • Example: netsh interface tcp show supplemental
7. show supplementalports:
   • Purpose: Lists the port ranges defined in the TCP supplemental filter table.
   • Details: This command shows which specific source or destination TCP port numbers (or ranges) will trigger the use of the supplemental TCP settings defined via show supplemental.
8. show supplementalsubnets:
   • Purpose: Lists the destination IP subnets defined in the TCP supplemental filter table.
   • Details: Similar to show supplementalports, this command shows which destination IP address subnets will trigger the use of the supplemental TCP settings.
9. set supplemental: Configures supplemental TCP settings.
   • Example: netsh interface tcp set supplemental template=internet
10. set heuristics: Enables or disables TCP heuristics.
    • Example: netsh interface tcp set heuristics disabled

Shows the current configuration of global TCP parameters

netsh interface tcp show global command displays the current configuration of global TCP parameters, which affect how TCP connections are handled across the system.

Картинка с сайта: cyberraiden.wordpress.com

TCP Global Parameters Explained

1. Receive-Side Scaling State:
   • Determines whether Receive-Side Scaling (RSS) is enabled, which allows incoming packets to be distributed across multiple CPU cores for better performance.
   • Typical values: enabled or disabled.
   • Example: enabled improves performance on multi-core systems.
2. Receive Window Auto-Tuning Level:
   • Controls how Windows automatically adjusts the TCP receive window size to optimize throughput.
   • Possible values: disabled, highlyrestricted, restricted, normal, experimental.
   • Example: normal is the default and works well for most scenarios; experimental may increase throughput but can cause compatibility issues.
3. Add-On Congestion Control Provider:
   • Specifies the TCP congestion control algorithm used to manage network congestion.
   • Common values: none, ctcp (Compound TCP), dctcp (Data Center TCP), or default.
   • Example: ctcp can improve throughput on high-latency networks.
4. ECN Capability:
   • Indicates whether Explicit Congestion Notification (ECN) is enabled, allowing routers to signal congestion without dropping packets.
   • Values: enabled or disabled.
   • Example: enabled can reduce packet loss but requires network support.
5. RFC 1323 Timestamps:
   • Controls whether TCP timestamps (per RFC 1323) are enabled to improve round-trip time (RTT) measurements and protect against wrapped sequence numbers.
   • Values: enabled or disabled.
   • Example: enabled is recommended for modern networks.
6. Initial RTO:
   • Sets the initial Retransmission Timeout (RTO) value in milliseconds, which determines how long TCP waits before retransmitting a packet.
   • Example: 1000 (1 second) is a common default.
7. Receive Segment Coalescing State:
   • Indicates whether Receive Segment Coalescing (RSC) is enabled, which combines multiple TCP segments into fewer larger ones to reduce CPU overhead.
   • Values: enabled or disabled.
   • Example: enabled improves performance for high-throughput networks.
8. Non Sack Rtt Resiliency:
   • Controls whether TCP connections without Selective Acknowledgments (SACK) are resilient to variations in round-trip time.
   • Values: enabled or disabled.
   • Example: disabled is typical unless specific network conditions require it.
9. Max SYN Retransmissions:
   • Specifies the maximum number of times a TCP SYN (synchronize) packet is retransmitted before giving up on establishing a connection.
   • Example: 2 or 3 is common.
10. Fast Open:
    • Indicates whether TCP Fast Open is enabled, allowing data to be sent in the initial SYN packet to reduce connection latency.
    • Values: enabled or disabled.
    • Example: enabled can improve performance for short-lived connections.
11. Fast Open Fallback:
    • Determines whether TCP falls back to standard connection setup if Fast Open fails.
    • Values: enabled or disabled.
    • Example: enabled ensures compatibility.
12. HyStart:
    • Controls whether the Hybrid Start algorithm is used to optimize the TCP slow-start phase, reducing packet loss.
    • Values: enabled or disabled.
    • Example: enabled is typical for better performance.
13. Proportional Rate Reduction:
    • Indicates whether Proportional Rate Reduction (PRR) is used during TCP recovery to smoothly adjust the sending rate after packet loss.
    • Values: enabled or disabled.
    • Example: enabled is recommended for modern networks.
14. Pacing Profile:
    • Specifies the TCP pacing profile, which controls how packets are spaced out to avoid bursts that could cause congestion.
    • Values: off, standard, or others depending on the system.
    • Example: standard helps smooth out traffic.

Displays the current configuration of TCP Window Scaling heuristics

The netsh interface tcp show heuristics command in Windows displays the configuration of TCP Window Scaling heuristics, which are algorithms used by the system to dynamically adjust the TCP receive window size based on network conditions and connection profiles. These heuristics help optimize network performance by balancing throughput and compatibility.

Картинка с сайта: cyberraiden.wordpress.com

TCP Window Scaling Heuristics Parameters Explained

1. Window Scaling Heuristics:
   • Purpose: Indicates whether TCP Window Scaling heuristics are turned on or off.
   • Typical Values: enabled or disabled.
   • Meaning:
     • enabled: Windows automatically adjusts the TCP receive window size to improve performance based on network conditions.
     • disabled: No dynamic adjustments are made, which might be set for troubleshooting or specific network needs.
   • Example: enabled allows adaptive scaling; disabled may be used for troubleshooting or specific network requirements.
2. Qualifying Destination Threshold:
   • Purpose: Specifies the number of connections to a destination that must occur before Windows applies heuristics to adjust the TCP window.
   • Typical Value: A number like 3.
   • Meaning: For example, if set to 3, Windows waits until it observes three connections to the same destination before enabling dynamic adjustments. This prevents unnecessary changes for rarely accessed destinations.
3. Profile Type Unknown:
   • Indicates the Window Scaling heuristics setting for network connections with an unknown profile (e.g., unidentified networks).
   • This setting applies when the network connection’s profile cannot be determined. The possible values are:
     • normal: Window scaling behaves normally.
     • restricted: Window scaling is more conservative, limiting growth in some scenarios.
     • highlyrestricted: Window scaling is very conservative.
     • disabled: Window scaling is disabled for this profile type.
4. Profile Type Public:
   • Specifies the Window Scaling heuristics setting for public network profiles (e.g., Wi-Fi hotspots).
   • This setting applies when the network connection is identified as a public network (e.g., in a coffee shop or airport). Public networks often have unpredictable characteristics, so Windows might use more restrictive heuristics. The possible values are the same as for “Profile type unknown.”
5. Profile Type Private:
   • This setting applies when the network connection is identified as a private network (e.g., your home or a trusted local network). Windows might be less restrictive with window scaling on private networks. The possible values are the same as above.
6. Profile Type Domain:
   • This setting applies when the computer is connected to a domain network (typically in a corporate environment). Domain networks are usually more controlled and predictable. The possible values are the same as the other profile types.

Additional Notes

• Checking Your Settings:
  • Open Command Prompt as Administrator and type netsh interface tcp show heuristics to view your system’s configuration.
• Modifying Settings:
  • You can change the global heuristics state with:
    • Disable: netsh interface tcp set heuristics disabled
    • Enable: netsh interface tcp set heuristics enabled
      Note: Profile-specific settings (e.g., Profile type public) are managed by Windows based on the global state and cannot be directly set via netsh.

Displays Receive Segment Coalescing (RSC) statistics for TCP connections

The netsh interface tcp show rscstats [[interface=]<string>] command in Windows displays Receive Segment Coalescing (RSC) statistics for TCP connections, either for a specific network interface or as a summary across all RSC-capable interfaces. RSC is a feature that allows network adapters to combine multiple TCP segments into fewer, larger segments, reducing CPU overhead and improving performance for high-throughput network tasks.

Since your query asks for this specific command, I’ll explain the expected output, what each statistic means, and how to interpret it. Note that the actual output depends on your system’s network activity and whether RSC is supported and enabled on your network adapter.

Command Syntax

• netsh interface tcp show rscstats [[interface=]]

• interface=<string>: The name or index of a network interface (e.g., “Ethernet”, “Wi-Fi”, or an index like “12”).
  • Use netsh interface show interface to list available interfaces and their names or indices.
  • If interface=<string> is specified, detailed RSC statistics are shown for the named interface (e.g., “Ethernet” or its index).
  • If omitted, summary statistics are displayed for all RSC-capable interfaces.

1. Without interface Parameter (Summary Statistics)

When you run netsh interface tcp show rscstats without specifying an interface, it provides a summary of RSC statistics across all RSC-capable interfaces.

Картинка с сайта: cyberraiden.wordpress.com

2. With interface Parameter (Detailed Statistics)

When you specify an interface (e.g., netsh interface tcp show rscstats interface=”16″), the command provides detailed RSC statistics for that specific interface with Interface index 16.

Output Parameters Explained

When you run the command with a specific interface, it returns detailed statistics. Here’s what each parameter means:

1. Interface Index
   • The unique numeric identifier assigned to the network interface.
   • Example: 12 (could correspond to “Ethernet”).
2. Supports IPv4 RSC
   • Indicates whether the network adapter and its driver support Receive Segment Coalescing for IPv4 traffic.
   • Possible Values: Yes (supported) or No (not supported).
3. Supports IPv6 RSC
   • Indicates whether the network adapter and its driver support Receive Segment Coalescing for IPv6 traffic.
   • Possible Values: Yes or No.
4. Current IPv4 RSC State
   • Shows whether RSC is currently active for IPv4 on this interface.
   • Possible Values: Enabled (RSC is on), Disabled (RSC is off), or Not Supported (adapter doesn’t support it).
5. Current IPv6 RSC State
   • Shows the current RSC state for IPv6 on this interface.
   • Possible Values: Enabled, Disabled, or Not Supported.
6. Number of TCP connections under RSC
   • This counter shows the number of active TCP connections for which RSC is currently being applied on this interface.
   • Example: 5 (five connections are benefiting from RSC).
7. Total number of SCUs indicated
   • The total number of Segment Coalescing Units (SCUs) reported by the adapter. An SCU is a single coalesced packet created from multiple smaller packets.
   • Example: 1000 SCUs.
8. Total size of all indicated SCUs
   • The total size (in bytes) of all SCUs processed by the adapter.
   • Example: 1500000 bytes.
9. Total number of Coalesced Packets
   • The total number of individual packets that have been combined into SCUs.
   • Example: 5000 packets.
10. Total number of Coalesced Bytes
    • The total size (in bytes) of all packets that were coalesced.
    • Example: 7500000 bytes.
11. Total number of Coalesce Events
    • The total number of times the adapter performed coalescing (i.e., grouped packets into an SCU).
    • Example: 1000 events.
12. Total number of Aborts
    • The number of times RSC coalescing was interrupted or failed (e.g., due to incompatible packets or errors).
    • Example: 10 aborts.
13. Reason last attempt to enable V4 RSC failed
    • If an attempt to enable RSC for IPv4 failed, this explains why.
    • Example: No failure (successful) or Hardware not supported (adapter limitation).
14. Reason last attempt to enable V6 RSC failed
    • If an attempt to enable RSC for IPv6 failed, this provides the reason.
    • Example: No failure or a specific error message.

Additional Notes

Requirements: RSC depends on hardware support in your network adapter. Check your adapter’s documentation or properties in Device Manager to confirm compatibility.

Administrator Access: Run the command in an elevated Command Prompt (as Administrator).

Reset Behavior: Statistics reset when the system reboots or RSC is toggled off and on.

Related Commands:

• Check global RSC settings: netsh interface tcp show global
• Enable/disable RSC: netsh interface tcp set global rsc=enabled or rsc=disabled

Receive Segment Coalescing (RSC) for TCP Connections

Receive Segment Coalescing (RSC) is a network optimization feature designed to enhance the performance of TCP connections by reducing the processing overhead on the CPU. It achieves this by combining multiple incoming TCP segments into a single larger segment before they are passed to the operating system’s TCP/IP stack. This process is particularly beneficial in high-throughput scenarios, such as large file transfers, streaming, or data center operations.

How RSC Works

RSC can be implemented either in the network interface card (NIC) or the operating system’s network stack. When enabled, it monitors incoming TCP segments that belong to the same connection. If multiple segments arrive in quick succession, RSC coalesces them into a single larger unit, often called a Segment Coalescing Unit (SCU). This reduces the number of individual packets that the CPU must process. For example, instead of handling 10 small packets separately, RSC might combine them into 2 larger packets, decreasing the overhead from packet headers and CPU interrupts.

Benefits of RSC

• Reduced CPU Utilization: By processing fewer packets, RSC lowers the CPU resources required for network operations, making it valuable in environments with heavy network traffic.
• Improved Throughput: The reduction in overhead can boost overall network performance, especially for bulk data transfers.
• Potential Latency Reduction: While RSC introduces a slight delay to coalesce segments, the decreased processing time can lead to lower overall latency for large data streams.

Potential Downsides

• Larger Impact of Packet Loss: If a coalesced segment is lost or corrupted, it affects a bigger chunk of data, which may result in more retransmissions.
• Unsuitable for Real-Time Applications: Applications like gaming or VoIP, which prioritize low latency and immediate packet delivery, may experience issues due to the coalescing delay.
• Hardware Dependency: RSC requires support from the network adapter, so it may not be available on older or less capable hardware.

Managing RSC in Windows

In Windows, you can manage RSC through the netsh command-line tool or the network adapter’s properties in Device Manager. Here are some useful commands:

• Check RSC Status: netsh interface tcp show global
  • Look for the “Receive Segment Coalescing State” (e.g., enabled or disabled).
• Enable RSC: netsh interface tcp set global rsc=enabled
• Disable RSC: netsh interface tcp set global rsc=disabled

Understanding Segment Coalescing Units (SCUs)

Segment Coalescing Units (SCUs) are a key component of Receive Segment Coalescing (RSC), a network optimization feature supported by certain network adapters. RSC enables the network adapter to combine multiple incoming TCP segments into fewer, larger segments before passing them to the operating system’s TCP stack. This process reduces the CPU overhead associated with handling a large number of small packets, making it particularly valuable in high-throughput network scenarios like file transfers, streaming, or data center operations.

What Are SCUs?

• Definition: An SCU is a single coalesced packet created by the network adapter by merging multiple smaller TCP segments into one larger segment.
• Purpose: The creation of SCUs reduces the number of individual packets the CPU needs to process, improving network performance by lowering the processing load.

For example, instead of the CPU handling 5,000 small packets individually, the network adapter might combine them into 1,000 SCUs, cutting the CPU’s workload by 80%.

How SCUs Work in RSC

1. Packet Reception: The network adapter receives multiple small TCP segments from the network.
2. Coalescing: If RSC is enabled and supported, the adapter groups these segments into larger SCUs.
3. Delivery: Each SCU is delivered to the TCP stack as a single unit, reducing CPU interrupts and processing cycles.
4. Result: Fewer, larger packets mean more efficient data processing, especially for high-bandwidth tasks.

Why SCUs Matter

• Performance Boost: A high SCU count relative to total packets indicates RSC is effectively reducing CPU workload, ideal for high-throughput environments.
• Use Case Dependency: While beneficial for large data transfers, SCUs might introduce latency in real-time applications (e.g., gaming or VoIP), where immediate packet processing is critical. In such cases, disabling RSC could be better.

Displays the TCP/IP security settings related to TCP connections

The netsh interface tcp show security command you ran displays the TCP/IP security settings related to TCP connections on your Windows system.

Картинка с сайта: cyberraiden.wordpress.com

1. Memory Pressure Protection (MPP)

• Definition: Memory Pressure Protection is a security feature in Windows that helps protect the TCP stack from resource exhaustion attacks, such as SYN flood attacks. It dynamically manages TCP connection resources when the system is under memory pressure, prioritizing legitimate connections and mitigating denial-of-service (DoS) risks.
• Status: enabled
  • Meaning: MPP is active on your system. When the TCP stack detects high memory usage or potential attack patterns (e.g., excessive half-open connections), it will take protective actions, such as dropping suspicious connections or limiting resource allocation.
  • Implications: This is a good default setting for security, especially on systems exposed to public networks. However, in rare cases, it might interfere with high-connection-volume applications (e.g., servers handling thousands of simultaneous connections).

2. Profiles

• Definition: In this context, “Profiles” refers to the configuration of network security profiles that apply TCP security settings based on the network type (e.g., public, private, domain). These profiles can influence how TCP connections are handled, including firewall rules and other security policies.
• Status: enabled
  • Meaning: Security profiles are active, meaning Windows is applying TCP-related security settings tailored to the network profile of each interface (e.g., stricter rules for public networks vs. more permissive rules for domain networks).
  • Implications: This ensures that TCP traffic is managed according to the security requirements of the network environment, enhancing protection on untrusted networks.

Display TCP Supplemental Parameters

The netsh interface tcp show supplemental command in Windows displays the supplemental TCP parameters that fine-tune the behavior of TCP connections. These parameters control advanced aspects of TCP performance, such as congestion control, retransmission timeouts, and loss recovery mechanisms. They are particularly relevant for optimizing network performance in specific scenarios, like high-latency networks, data centers, or environments with packet loss.

Картинка с сайта: cyberraiden.wordpress.com

TCP Supplemental Parameters Explained

1. Minimum RTO (msec)
   • Description: The minimum Retransmission Timeout (RTO) in milliseconds. This is the minimum amount of time (in milliseconds) that TCP will wait for an acknowledgment (ACK) after sending a segment before retransmitting that segment.
   • Typical Value: 300 (0.3 seconds) or lower (e.g., 200 in modern systems).
   • Significance: A lower value reduces latency for retransmissions but may increase unnecessary retransmissions in high-latency networks.
2. Initial Congestion Window (MSS)
   • Description: The initial size of the TCP congestion window, measured in Maximum Segment Size (MSS) units. The Initial Congestion Window (ICW) determines the maximum number of TCP segments (in units of Maximum Segment Size, or MSS) that can be sent initially before receiving any acknowledgments.
   • Typical Value: 10 (modern default, per RFC 6928) or 4 (older systems).
   • Significance: A larger initial window (e.g., 10) improves performance for short-lived connections by allowing more data to be sent initially, but it risks congestion on low-bandwidth networks.
3. Congestion Control Provider
   • Description: The algorithm used to manage TCP congestion, controlling how the sender adjusts the data rate in response to network conditions.
   • Typical Values: default, ctcp (Compound TCP), dctcp (Data Center TCP), or cubic (on some systems).
   • Significance:
     • ctcp: Optimizes for high-latency, high-bandwidth networks.
     • dctcp: Designed for data centers with low latency and high bandwidth.
     • default: Uses the system’s standard algorithm (often NewReno or a variant).
4. Enable Congestion Window Restart
   • Description: Indicates whether the TCP congestion window is reset after an idle period, restarting the slow-start phase.
   • Typical Values: enabled or disabled.
   • Significance:
     • Enabled: Ensures conservative behavior after idle periods, reducing the risk of congestion.
     • Disabled: Maintains the congestion window, which can improve performance for applications with intermittent traffic but risks overwhelming the network.
5. Delayed ACK Timeout (msec)
   • Description: The time TCP waits before sending an acknowledgment (ACK) for received data, allowing multiple segments to be acknowledged together.
   • Typical Value: 200 (0.2 seconds) or lower.
   • Significance: A shorter timeout reduces latency but increases ACK packet overhead; a longer timeout saves bandwidth but may delay data flow.
6. Delayed ACK Frequency
   • Description: The number of segments received before sending an ACK, if the delayed ACK timer hasn’t expired. A value of 2 means that an ACK will be sent for approximately every other received data segment (unless the delayed ACK timeout expires sooner).
   • Typical Value: 2 (ACK sent after every two segments).
   • Significance: Higher values reduce ACK overhead but may delay sender’s data transmission if segments arrive slowly.
7. Enable RACK
   • Description: Indicates whether Recent Acknowledgment (RACK) is enabled. RACK is a loss detection algorithm that uses the time packets were sent and received to identify losses more accurately than traditional methods.
   • Typical Values: enabled or disabled.
   • Significance:
     • Enabled: Improves recovery from packet loss, especially in networks with reordering or high latency.
     • Disabled: Falls back to older loss detection (e.g., duplicate ACKs), which may be less efficient.
8. Enable Tail Loss Probe
   • Description: Indicates whether Tail Loss Probe (TLP) is enabled. Tail Loss Probe (TLP) is another TCP enhancement designed to improve performance in high-bandwidth, high-latency networks. It helps to quickly recover from the loss of the last few packets in a transmission window (tail losses) by proactively sending a few probe packets. TLP sends a probe packet to detect and recover from losses at the end of a data burst (tail losses), reducing delays.
   • Typical Values: enabled or disabled.
   • Significance:
     • Enabled: Speeds up recovery from tail losses, improving performance in lossy networks.
     • Disabled: May result in longer delays for tail loss recovery.

Configure global TCP parameters

The netsh interface tcp set global command in Windows allows you to configure global TCP parameters that affect the behavior of TCP connections across all network interfaces. These settings control aspects like performance optimization, congestion control, retransmission behavior, and security features.

Command Syntax

• netsh interface tcp set global
  • rss= disabled|enabled|default
  • [[autotuninglevel=]disabled|highlyrestricted|restricted|normal|experimental]
  • [[ecncapability=]disabled|enabled|default]
  • [[timestamps=]disabled|enabled|default]
  • [[initialrto=]<300-3000>]
  • [[rsc=]disabled|enabled|default]
  • [[nonsackrttresiliency=]disabled|enabled|default]
  • [[maxsynretransmissions=]<2-8>]
  • [[fastopen=]disabled|enabled|default]
  • [[fastopenfallback=]disabled|enabled|default]
  • [[hystart=]disabled|enabled|default]
  • [[prr=]disabled|enabled|default]
  • [[pacingprofile=]off|initialwindow|slowstart|always|default]
• Usage: Run this command in an elevated Command Prompt (as Administrator) to modify TCP settings.
• Parameters: Each parameter is optional, and you can specify one or more in a single command. If a parameter is omitted, its current value remains unchanged.
• Default: Setting a parameter to default reverts it to the system’s default configuration.

Картинка с сайта: cyberraiden.wordpress.com

Картинка с сайта: cyberraiden.wordpress.com

Here’s a breakdown of each parameter you can set:

1. rss= disabled|enabled|default

• RSS (Receive Side Scaling): This feature enables network adapters to distribute the processing of incoming network traffic across multiple CPU cores. Enabling RSS can significantly improve network performance, especially on multi-core systems with high network throughput.
  • Options:
    • disabled: Turns off RSS.
    • enabled: Turns on RSS.
    • default: Reverts to the system’s default RSS setting.
  • Example: netsh interface tcp set global rss=enabled

[[autotuninglevel=]disabled|highlyrestricted|restricted|normal|experimental]

• Autotuning Level: This parameter controls the TCP receive window auto-tuning mechanism. Auto-tuning dynamically adjusts the TCP receive window size based on network conditions (e.g., bandwidth, latency, and congestion). The receive window determines how much data the sender can transmit before receiving an acknowledgment, impacting throughput.
  • disabled
    • Description: Disables auto-tuning entirely. The TCP receive window size is fixed and does not adjust dynamically.
    • When to Use:
      • For troubleshooting network issues where auto-tuning might be causing problems.
      • On older networks or devices that don’t handle dynamic window sizes well.
      • When you need precise control over the receive window (rare).
    • Drawbacks: May result in suboptimal performance, especially on modern high-speed networks, as the fixed window size might not adapt to changing conditions.
  • highlyrestricted
    • Description: Allows minimal dynamic adjustments to the receive window, staying close to a conservative fixed size.
    • When to Use:
      • In environments with legacy network equipment that struggles with aggressive window scaling.
      • When you want some tuning but need to avoid significant changes.
    • Drawbacks: Limits performance benefits compared to normal or experimental, but safer than disabled.
  • restricted
    • Description: Permits moderate dynamic adjustments to the receive window, balancing performance and compatibility.
    • When to Use:
      • In mixed environments where some network devices support modern TCP features but others are less capable.
      • When you need a middle ground between performance and stability.
    • Drawbacks: May not fully optimize throughput on high-bandwidth networks.
  • normal
    • Description: The default setting in modern Windows systems. It enables full dynamic auto-tuning, adjusting the receive window based on network conditions to maximize throughput.
    • When to Use:
      • For most general-purpose scenarios, including home, office, or internet-facing networks.
      • Works well for typical applications like web browsing, streaming, and file transfers.
    • Drawbacks: May cause issues with older routers or firewalls that mishandle large window sizes.
  • experimental
    • Description: Enables aggressive auto-tuning, allowing the receive window to scale to very large sizes for maximum throughput.
    • When to Use:
      • In high-bandwidth, low-latency environments (e.g., data centers, high-speed LANs).
      • For applications requiring maximum network performance (e.g., large file transfers, cloud services).
    • Drawbacks:
      • Can cause compatibility issues with some routers, firewalls, or network devices that don’t handle large windows well.Increases memory usage due to larger buffers.Should be tested thoroughly before use in production.

[[ecncapability=]disabled|enabled|default]

• ECN (Explicit Congestion Notification): This is an optional extension to the IP protocol that allows routers to signal network congestion to the endpoints without dropping packets. Enabling ECN can lead to smoother throughput and reduced packet loss on networks that support it. ECN is an extension to the TCP/IP protocol (defined in RFC 3168) that allows routers to mark packets with a congestion signal when network queues are filling up, rather than dropping them.
• How It Works:
  • Routers set ECN bits in the IP header (ECN-Capable Transport, ECT) to indicate congestion.
  • The receiving endpoint detects these marks and informs the sender via TCP acknowledgments.
  • The sender reduces its transmission rate (similar to how it responds to packet loss) to alleviate congestion.
• Key Benefit: Reduces packet loss, which improves throughput and reduces retransmissions, especially in high-traffic or congested networks.
• Options
  • disabled: Disables ECN. Prevents TCP from using ECN, falling back to traditional packet-dropping behavior for congestion control.
  • enabled: Enables ECN. Allows TCP to negotiate and use ECN for connections, provided the remote endpoint and network devices support it.
  • default: Reverts to the system’s default ECN setting.
• Use Case: Enable for modern networks to reduce packet loss; disable for compatibility with older routers that mishandle ECN.
• Example: netsh interface tcp set global ecncapability=enabled

[[timestamps=]disabled|enabled|default]

• TCP Timestamps: These are options included in TCP headers that can help with Round-Trip Time (RTT) measurement and other performance optimizations.
  • Options:
    • disabled: Disables TCP timestamps.
    • enabled: Enables TCP timestamps.
    • default: Reverts to the system’s default TCP timestamp setting.
  • Use Case: Enable for modern, high-speed networks; disable for older networks where timestamps increase overhead.
  • Example: netsh interface tcp set global timestamps=enabled

[[initialrto=]<300-3000>]

• Initial RTO (Retransmission Timeout): This parameter allows you to set the initial timeout value (in milliseconds) that TCP uses before retransmitting an unacknowledged segment during connection establishment. This setting applies globally to all TCP connections on the system and can significantly impact network performance, especially in scenarios with varying latency or packet loss.
  • Range: The value must be between 300 and 3000 milliseconds.
  • Use Case: Lower values (e.g., 300) reduce latency in low-latency networks; higher values (e.g., 1000) are better for high-latency networks to avoid premature retransmissions.
  • Modifying this is generally not recommended unless you have a specific reason related to unusual network conditions.
  • Example: netsh interface tcp set global initialrto=500

[[rsc=]disabled|enabled|default]

• RSC (Receive Segment Coalescing): As we discussed earlier, this feature helps reduce CPU utilization by combining multiple incoming TCP/IP packets into larger segments before they are processed.
  • Options:
    • disabled: Disables RSC.
    • enabled: Enables RSC.
    • default: Reverts to the system’s default RSC setting.
  • Use Case: Enable for high-throughput scenarios (e.g., file transfers); disable for latency-sensitive applications (e.g., gaming).
  • Example: netsh interface tcp set global rsc=enabled

[[nonsackrttresiliency=]disabled|enabled|default]

• Non-SACK RTT Resiliency: This setting likely relates to how TCP estimates the Round-Trip Time (RTT) for connections that do not support Selective Acknowledgment (SACK). Enabling this might improve performance on networks with older equipment or protocols.
  • Options:
    • disabled: Disables this resiliency feature.
    • enabled: Enables this resiliency feature.
    • default: Reverts to the system’s default setting.
  • Use Case: Enable for networks with fluctuating latency; disable for stable networks to avoid unnecessary adjustments.
  • Example: netsh interface tcp set global nonsackrttresiliency=enabled

[[maxsynretransmissions=]<2-8>]

• Max SYN Retransmissions: This parameter controls the number of times TCP will retransmit the initial SYN (synchronize) packet when attempting to establish a new connection before giving up.
  • Range: The value must be between 2 and 8.
  • Use Case: Increase (e.g., 4) for unreliable networks; decrease (e.g., 2) for faster failure detection in responsive networks.
  • Increasing this might help in very unreliable networks where initial connection attempts are often dropped, but it can also delay connection failure if the destination is unreachable.
  • Example: netsh interface tcp set global maxsynretransmissions=3

[[fastopen=]disabled|enabled|default]

• TCP Fast Open: This is a TCP extension that allows data to be included in the initial SYN packet during the connection establishment, potentially reducing the round trips needed for the start of data transfer for subsequent connections to the same server.
  • Options:
    • disabled: Disables TCP Fast Open.
    • enabled: Enables TCP Fast Open.
    • default: Reverts to the system’s default TCP Fast Open setting.
  • Use Case: Enable for faster web browsing or short-lived connections; disable for compatibility with networks that block TFO.

[[fastopenfallback=]disabled|enabled|default]

• TCP Fast Open Fallback: This setting likely controls whether TCP should fall back to a standard three-way handshake if the Fast Open attempt fails (e.g., the server doesn’t support it).
  • Options:
    • disabled: Disables the fallback mechanism.
    • enabled: Enables the fallback mechanism.
    • default: Reverts to the system’s default fallback setting.
  • Use Case: Enable for compatibility; disable to enforce Fast Open (rarely needed).

[[hystart=]disabled|enabled|default]

• HyStart (Hybrid Start): This is an enhancement to the TCP slow start algorithm that aims to more quickly reach the available bandwidth by using RTT measurements to detect the onset of congestion.
  • Options:
    • disabled: Disables HyStart.
    • enabled: Enables HyStart.
    • default: Reverts to the system’s default HyStart setting.
  • Use Case: Enable for better performance in congested networks; disable for highly stable networks.
  • Example: netsh interface tcp set global hystart=enabled

[[prr=]disabled|enabled|default]

• PRR (Proportional Rate Reduction): This is a TCP congestion control mechanism used during recovery after packet loss. It aims to send a number of bytes proportional to the number of acknowledged bytes during the recovery phase, leading to smoother bandwidth utilization.
  • Options:
    • disabled: Disables PRR.
    • enabled: Enables PRR.
    • default: Reverts to the system’s default PRR setting.
  • Use Case: Enable for modern networks to improve recovery; disable for compatibility with older systems.
  • Example: netsh interface tcp set global prr=enabled

[[pacingprofile=]off|initialwindow|slowstart|always|default]

• TCP Pacing Profile: TCP pacing aims to smooth out packet transmission over time, potentially reducing bursts and improving network stability, especially on congested links. Different profiles might apply pacing during different phases of the connection.
  • Options:
    • off: Disables TCP pacing.
    • initialwindow: Applies pacing during the initial congestion window phase.
    • slowstart: Applies pacing during the slow start phase.
    • always: Pacing for all transmissions.
    • default: Reverts to the system’s default pacing profile (often off or slowstart).
  • Use Case: Set to always or slowstart for congested networks; use off for low-latency, high-bandwidth networks.
  • Example: netsh interface tcp set global pacingprofile=slowstart

Example_1

Set the auto-tuning level to Normal, run the command:

• netsh interface tcp set global autotuninglevel=normal

To verify the configuration, run the command:

• netsh interface tcp show global store=active

Картинка с сайта: cyberraiden.wordpress.com

Example_2

What is Explicit Congestion Notification (ECN)?

• Definition: ECN is an extension to the TCP/IP protocol (defined in RFC 3168) that allows routers to mark packets with a congestion signal when network queues are filling up, rather than dropping them.

Benefits of Enabling ECN

1. Reduced Packet Loss: By signaling congestion without dropping packets, ECN helps maintain data flow and reduces the need for retransmissions.
2. Improved Throughput: Fewer dropped packets mean more consistent performance, especially in high-bandwidth or congested networks (e.g., data centers, busy Wi-Fi networks).
3. Better Congestion Management: ECN allows endpoints to proactively reduce transmission rates, preventing network overload.
4. Modern Network Compatibility: Many modern networks and applications (e.g., cloud services, streaming) benefit from ECN support.

Potential Issues with ECN

1. Compatibility Problems:
   • Some older routers, firewalls, or network devices may not support ECN or may mishandle ECN-marked packets, leading to connection issues or dropped packets.
   • Certain ISPs or enterprise networks may block or misinterpret ECN, causing performance degradation.
2. Limited Adoption:
   • ECN requires support from both endpoints (sender and receiver) and intermediate network devices. If any part of the path doesn’t support ECN, it falls back to traditional congestion control.
3. Debugging Challenges:
   • Misconfigured ECN can be hard to diagnose, as issues may appear as generic connectivity problems.
4. Minimal Impact in Low-Congestion Networks:
   • In stable, low-traffic networks (e.g., a small LAN), ECN’s benefits may be negligible.

When to Enable or Disable ECN

• Enable ECN (enabled):
  • Use Case: Modern networks with ECN-capable devices, such as data centers, cloud environments, or high-traffic internet connections.
  • Scenarios: File transfers, streaming, web browsing, or any application benefiting from reduced packet loss.
  • Example Environments: Home networks with modern routers, enterprise networks, or cloud-hosted servers.
• Disable ECN (disabled):
  • Use Case: Legacy networks or environments with known ECN compatibility issues.
  • Scenarios: Older routers/firewalls, certain ISP networks, or when troubleshooting connectivity issues.
  • Example Environments: Legacy corporate networks, outdated home routers, or specific VPN setups.

To Enable the Explicit Congestion Notification (ECN), run the command:

• netsh interface tcp set global ecncapability=enabled

To verify the configuration, run the command:

• netsh interface tcp show global store=active

Картинка с сайта: cyberraiden.wordpress.com