Troubleshooting the internet access delay

Products

• VMWare SD-WAN
• VMware Secure Access
• VMware VeloCloud Cloud Web Security

Issue/Introduction

In some case, customer encounters an internet access delay. In this KB, it puts together tips for troubleshooting the internet browsing delay.

 

Key point

The throughput of TCP/IP is calculated by the following formula.
‘Amount of data that can be received at one time (65,535 bytes for a Window size of 64K) ÷ Delay time (RTT) until completion of reception of the left column’.

If the Window size on each link was around 64K, the difference in delay time makes a difference to the measured speed.

Resolution

Case1 Internet access via Secure Access is slow 

At first, please check Secure Logs level on GROUPS & SETTING -> Configuration -> Tunnel -> Logging in Workspace ONE UEM.
If the Debug or Info levels are set, the amount of logging and writing will slow down traffic significantly.
If the Secure Logs is set to Warning level or higher, please Please follow the procedure in Secure Access Troubleshooting to get packet capture and check Windows size and TTL.

 

 

 

Case2 internet access is slow from web browser.

You can get a HAR file for analysis and check "Stailled" and "Proxy negotiation" time on HAR file. These time are also said "blocked time".

 

The blocked time indicates the time the request was waiting for the browser to send it.

http://www.softwareishard.com/blog/har-12-spec/#timings
>blocked [number, optional] - Time spent in a queue waiting for a network connection. Use -1 if the timing does not apply to the current request.

 

And the number of sessions that can be connected to from the browser is a maximum of six connections per host. For example, Chrome browser is the below.
https://support.google.com/chrome/a/answer/3339263

It means if the number of sessions exceeds 6, the blocking time will increase as the browser waits for other sessions to finish.
e.g. if multiple pages are open in the browser, the maximum number of connections from the browser is reached, so the web page will take longer to load.

 

 

Case3 Slow speed measurement results on one of several links

In the case that customer faced Slow speed measurement results on one of several links, we need to check the following.

1. perform measurements at the exact same speed measurement site while retrieving the HAR file.
2. compare the download speed of the exact same file from the HAR file.
3. load the HAR file and check the Response Header at the following site
https://toolbox.googleapps.com/apps/har_analyzer/

In some cases, for example, the Proxy is confirmed as "Via 1.1 c6f6ffc0 (squid)" only on the link where the delay is occurring. 

Also, there are cases where there is a difference in the number of bytes in HTTP Compressed. Since compression is a means of improving website performance, we believe that this behavior also makes a difference in transfer speed.
In some case, we encountered cases where the specific link has the HTTP compression 4,096 bytes and other link has 49,152 bytes.