TCP window scaling is enabled by default on CensorNet servers. This in theory should be fine for 99% of all installations however sometimes, without explanation, certain web sites can become slow or have intermittent access if a router somewhere in the chain does not support TCP window scaling. If this is happening or if there is other inexplicable behaviour whilst browsing (such as slowness), it might be worth turning TCP window scaling off.

Before disabling TCP window scaling, you should rule out the following potential causes of Internet slow down:-

• Check CPU resource use with "top", if it's idling a lot then OK...
• Check memory usage (+/- buffers/cache line) using "free -m", if there's lots of RAM free then OK...
• Check disk IO performance using "hdparm -t /dev/...", ... being where the root partition is, if it's above 40MB/sec, it's OK
• If they are using NTLM user auth, this may be the bottleneck so suggest increasing the NTLM threads as per the Wiki article
• Check the speed and accuracy of DNS lookups using nslookup, if it's slow then fix the DNS server.

If none of these things help, then try switching off TCP window scaling:

echo 0 > /proc/sys/net/ipv4/tcp_window_scaling

This will disable it until you reboot the CensorNet server.

In order to make the command persist through reboots type these commands

cd /etc/init.d nano networking

Type Ctrl-W start) and press the RETURN key.

You will find a block of code that looks as follows :

start)
  process_options

  log_action_begin_msg "Configuring network interfaces"
  if ifup -a; then
    log_action_end_msg $?
  else
    log_action_end_msg $?
  fi
  ;;

Add the command after the fi but before the ;; so that the new block looks like :

em>start)
  process_options

  log_action_begin_msg "Configuring network interfaces"
  if ifup -a; then
    log_action_end_msg $?
  else
    log_action_end_msg $?
  fi
  echo 0 > /proc/sys/net/ipv4/tcp_window_scaling
  ;;

Now type CTRL-O and RETURN to write the file. Press Ctrl-X to exit the editor.

The command will now be executed any time you reboot the CensorNet.

-- TimLloyd - 13 May 2009