Method / Tools to analyze temporarily bandwith collapse

A good place to start is with a tool like netperf. Google to find it

• Start the netserver binary on your vhost

• From your client run netperf: netperf -H <serverIP> -f M -l 240 -- -s 4194304

  • -f M (show output in MB/s)
  • -l (length in seconds)
  • -- (options follow the two dashes)
  • -s (socket size)

This is an easy way to find the right socket/buffer size. For example, the default socket size in Windows is only 8192. A copy using drag and drop will use this default size and you'll max out at around 22 MB/s. Once you increase that to 64k you'll start seeing your 100-120 MB/s. Most software these days allow you to change this or will hard code their tested sweet spot. So if using winscp, or filezilla or whatever utility for these file transfers then you'll want to check your TCP buffers in Linux, and your winsock buffers in Windows.

Linux Example: /etc/sysctl.conf

• net.ipv4.tcp_rmem = 4194304 4194304 4194304
• net.ipv4.tcp_wmem = 4194304 4194304 4194304

Windows: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters

• DefaultReceiveWindow = 65536
• DefaultSendWindow = 65536

Reboot

If you can run netperf for over your 120 seconds and don't see your trough, but then copy actual data to disk and still see it then you can move on to troubleshooting your disk. If you try various buffer/socket sizes and still see the decrease then my next step would be a packet capture.

On the vhost:

1. tcpdump -i <interface> -vvv -nn -s0 port 12865 -w /desiredDir/troughTest.cap
2. netserver
3. From client: netperf -H <serverIP> -f M -l 300 -- -s 4194304

Let that run for a while then ctrl-c or kill it when you think you've got enough packets. Last, ctrl-c your tcpdump, transfer your /desiredDir/troughTest.cap file to your laptop/workstation, install wireshark if you haven't already, analyze packets