Brocade Virtual ADX Security Guide (Supporting ADX v03.1.00) - Manual (Page 150)

138 Brocade Virtual ADX Security Guide
53-1003250-01
Configuration examples for SSL Termination Mode
6
Resolution
There two possible approaches to this problem.
• Turn OFF delayed ACK on the server. To see how to modify or turn off delayed ACK on Windows
2003 servers, go to the following location:
http://support.microsoft.com/default.aspx?scid=kb;en-us;823764
NOTE
This method might not be the most satisfactory, as it involves changing the registry on the
servers.
• Turn OFF Nagle Algorithm on the Brocade Virtual ADX. Bind the TCP-profile to the port under
virtual server.
The TCP Nagle Algorithm
The Nagle Algorithm was developed to address the TCP small packet problem. This problem is
typically experienced when an application generates several small bytes of data at a time. As an
example, one byte of user data could mean 41 bytes of packet, with 40 bytes of overhead. This
situation is often referred to as the “send-side silly window” syndrome.
The Nagle Algorithm instructs the sender to buffer the data if any unacknowledged data is
outstanding. Any data to be sent subsequently is held until the outstanding data is acknowledged
or until there is a full packet's worth of data to send. Small amounts of data are collected by TCP
and sent in a single segment.
Sometimes the Nagle Algorithm needs to be turned OFF. For example, in X-Window system, the
small size messages (such as mouse movements) need to be delivered without any delay to
provide real-time feedback for an interactive user.
Delayed TCP ACK
A host that is receiving a stream of TCP data segments can increase efficiency by sending fewer
ACKs (acknowledgements) per data segment received using a TCP delayed ACK mechanism. A TCP
should implement delayed ACKs, but no ACK should be excessively delayed.Specifically, the delay
MUST be less than 0.5 seconds, and in a stream of full-sized segments there should be an ACK for
at least every second segment.
The following example configures a TCP profile that turns off the delayed ACK, the Nagle Algorithm,
and disables all outgoing data packets except the last one from a TCP-transmit queue. The TCP
profile is then applied to virtual servers
Creating a TCP Profile
You can disable the following TCP features within a TCP profile: Nagle’s algorithm, the delayed ACK
algorithm, and all outgoing data packets except the last one from a tcp-transmit queue. The
following example creates a TCP profile named "nagleoff" within the General Configuration mode.
Virtual ADX(config)#tcp profile nagleoff
Virtual ADX(config-tcp-profile-nagleoff)#nagle off
Virtual ADX(config-tcp-profile-nagleoff)#delayed-ack off
Virtual ADX(config-tcp-profile-nagleoff)#push-bit off