I need to figure out why a TCP link we use is failing. The TCP link streams data from an instrument to a logging system continuously over a dedicated NIC pair. The data volume is quite high although in general the Network usage rarely exceeds 10% (of a Gigabit link).

I have installed and run Windump successfully and I am able to see what happens immediately prior to the failure.

The failure always occurs eventually, but sometimes only after many hours. On every occasion I notice that even whiel the link is “up” the TCP receive window size varies from the default maximum up and down sometimes dropping very low (104) and usually recovering. But at some point the size drops to zero at which point the instrument stops sending and goes into “persist timer” then all I see is occasional (60 secs) requests from the instrument to the logging system; each time the logger responds with recieve window zero so the connection is effectively dead.

Simply going online and online at the logging end restores the connection.

The programmers I work with seem not have many ideas about this problem so any help is much appreciated.