Monitoring Data Transmission Rates at Different OSI Layers

Applies To: Windows Server 2003, Windows Server 2003 with SP1

The simplest measure of the effective bandwidth of a server is the rate at which the server sends and receives data. System Monitor displays counts of data transmissions that are collected by many components of the server computer.

The components that collect data reside in different layers of the OSI reference model:

• Counters on the Web, FTP, and Simple Mail Transfer Protocol (SMTP) services performance objects measure data transmitted at the OSI application layer.

• Counters on the TCP object measure data transmitted at the transport layer.

• Counters on the IP object measure data at the network layer.

• Counters on the Network Interface object measure data at the data-link layer.

As a result of their different positions in the OSI stack, the counters collect different data. For example, the counters at the application layer measure data in the form in which the application sends it, counting the bytes sent before the data is divided into packets and prefixed with protocol headers and control packets. Counters at the application layer do not include retransmitted data.

In addition, the counters display the data in units native to the component being measured. For example, the Web Service object displays data in bytes, and the TCP object displays data in segments.

For more information about TCP/IP and about the OSI reference model, see Additional Resources for IIS 6.0 Performance.

Tables 6.5 through 6.8 list and describe some of the counters that can be used to measure transmission rates. These counters display the transmission rates observed during the last sample interval; they do not display a rolling or cumulative average of the rate.

Table 6.5 lists counters at the application layer. As with all the Web Service counters, these collect data that shows the rate at which the WWW service (a user-mode service) is sending and receiving bits. These counters do not measure the transmittal rates for HTTP.sys.

The IIS 6.0 service counters listed in Table 6.5 display the number of bytes transmitted on behalf of each service that runs on the server. To calculate the total number of bytes sent or received by all IIS 6.0 services, calculate the sum of the values for each service. To determine the proportion of bytes transmitted by each service, compute the ratio of bytes for one service to the sum of bytes for all services or for the network.

Data collected by the IIS 6.0 service counters underestimates the total number of bytes that the IIS 6.0 services actually transmit to the network. Because these values are collected at the application layer, they measure data only. They do not measure protocol headers, control packets, or retransmitted bytes. In general, the bytes counted by the services represent 60 to 70 percent of the total number of bytes transmitted by the services on the network. If the sum of bytes for all services accounts for two-thirds or more of total network bandwidth, you can assume that your network is running at or near the total capacity of its communications link.

If you are using bandwidth throttling to limit the amount of bandwidth that the WWW service or an individual Web site uses, or you want to evaluate whether bandwidth throttling might be useful, monitor the Web Service\Bytes Total/sec and the Web Service\Bytes Sent/sec counters. These counters can indicate whether your Web server has sufficient bandwidth to handle its load. If it does not, consider using bandwidth throttling to redistribute network availability.

For information about using bandwidth throttling, see Throttling Bandwidth to Manage Service Availability.

Table 6.6 lists the counters on the TCP object. These counters monitor TCP segments — the unit of data that TCP sends down the protocol stack to IP. Windows Server 2003 provides two TCP objects, TCPv4 and TCPv6. Choose the counter that monitors the version of TCP that your server uses.

Table 6.7 describes lists some of the datagram counters for the IP object. These counters monitor IP datagrams, which are the units of data that IP sends down the protocol stack to the network interface, such as a network adapter. The sum of IP\Datagrams/sec and IP\Datagrams Forwarded/sec represents the rate at which the server handles all IP datagrams.

Counters on the TCP and IP performance objects display the rate at which data is sent and received over a TCP/IP connection at the transport and network layers, but the rate is not expressed in bytes. Counters on the IP performance object display data in datagrams, and counters on the TCP performance object display data in segments. It is difficult to convert segments to bytes because bytes per segment can vary from 8 KB to 64 KB (the size can increase to 1 gigabyte [GB] if a window scaling option is in effect), depending upon the size of the TCP/IP receive window and the maximum segment size negotiated when each connection is established.

Table 6.8 lists several counters on the Network Interface performance object that might be useful for obtaining data about the network adapters on the server. The first instance of the Network Interface object that you see in System Monitor represents the loopback — a local path through the protocol driver and the network adapter; all other instances represent installed network adapters.

Counters for the Network Interface performance object display the rate at which bytes are transmitted over a TCP/IP connection by monitoring the counters on the network adapter at the data-link layer. The values of these Network Interface counters include all prepended frame header bytes and bytes that have been retransmitted. They provide a relatively accurate estimate of the number of bytes transmitted over the network, but do not measure the bytes transmitted by a specific IIS 6.0 service.

It is useful to compare the data produced by these counters with other performance measures, such as the total number of connections served at a given bandwidth or processor use at different throughput rates.