ServerIron ADX Security Guide 181
53-1002440-03
Configuration Examples for SSL Termination and Proxy Modes 6
Resolution
There two possible approaches to this problem.
•Turn OFF delayed ACK on the server. To see how to modify or turn off delayed ACK on Windows
2003 servers, go to the following location:
http://support.microsoft.com/default.aspx?scid=kb;en-us;823764
NOTE
This method might not be the most satisfactory, as it involves changing the registry on the
servers.
•Turn OFF Nagle Algorithm on the ServerIron. Bind the TCP-profile to the port under virtual
server.
The TCP Nagle Algorithm
The Nagle Algorithm was developed to address the TCP small packet problem. This problem is
typically experienced when an application generates several small bytes of data at a time. As an
example, one byte of user data could mean 41 bytes of packet, with 40 bytes of overhead. This
situation is often referred to as the “send-side silly window” syndrome.
The Nagle Algorithm instructs the sender to buffer the data if any unacknowledged data is
outstanding. Any data to be sent subsequently is held until the outstanding data is acknowledged
or until there is a full packet's worth of data to send. Small amounts of data are collected by TCP
and sent in a single segment.
Sometimes the Nagle Algorithm needs to be turned OFF. For example, in X-Window system, the
small size messages (such as mouse movements) need to be delivered without any delay to
provide real-time feedback for an interactive user.
Delayed TCP ACK
A host that is receiving a stream of TCP data segments can increase efficiency by sending fewer
ACKs (acknowledgements) per data segment received using a TCP delayed ACK mechanism. A TCP
should implement delayed ACKs, but no ACK should be excessively delayed.Specifically, the delay
MUST be less than 0.5 seconds, a nd in a stream of full-sized segments there should be a n ACK for
at least every second segment.
The following example configures a TCP profile that turns off the delayed ACK, the Nagle Algorithm,
and disables all outgoing data packets except the last one from a tcp-transmit queue. The TCP
profile is then applied to Virtual Servers
Creating a TCP Profile
You can disable the following TCP features within a TCP profile: Nagle’s algorithm, the delayed ACK
algorithm, and all outgoing data packets except the last one from a tcp-transmit queue. The
following example creates a TCP profile named "nagleoff" within the General Configuration mode.
ServerIronADX(config)# tcp profile nagleoff
ServerIronADX(config-tcp-profile-nagleoff)# nagle off
ServerIronADX(config-tcp-profile-nagleoff)# delayed-ack off
ServerIronADX(config-tcp-profile-nagleoff)# push-bit off