Monitoring Data Transmission Rates at Different OSI Layers
Applies To: Windows Server 2003, Windows Server 2003 with SP1
The simplest measure of the effective bandwidth of a server is the rate at which the server sends and receives data. System Monitor displays counts of data transmissions that are collected by many components of the server computer.
The components that collect data reside in different layers of the OSI reference model:
Counters on the Web, FTP, and Simple Mail Transfer Protocol (SMTP) services performance objects measure data transmitted at the OSI application layer.
Counters on the TCP object measure data transmitted at the transport layer.
Counters on the IP object measure data at the network layer.
Counters on the Network Interface object measure data at the data-link layer.
As a result of their different positions in the OSI stack, the counters collect different data. For example, the counters at the application layer measure data in the form in which the application sends it, counting the bytes sent before the data is divided into packets and prefixed with protocol headers and control packets. Counters at the application layer do not include retransmitted data.
In addition, the counters display the data in units native to the component being measured. For example, the Web Service object displays data in bytes, and the TCP object displays data in segments.
For more information about TCP/IP and about the OSI reference model, see Additional Resources for IIS 6.0 Performance.
Tables 6.5 through 6.8 list and describe some of the counters that can be used to measure transmission rates. These counters display the transmission rates observed during the last sample interval; they do not display a rolling or cumulative average of the rate.
Counters for Monitoring Data Transmission Rates at the Application Layer
Table 6.5 lists counters at the application layer. As with all the Web Service counters, these collect data that shows the rate at which the WWW service (a user-mode service) is sending and receiving bits. These counters do not measure the transmittal rates for HTTP.sys.
Table 6.5 Counters for Measuring Data Transmission Rates at the Application Layer
| Object\Counter | Value |
|---|---|
Web Service\Bytes Sent/sec |
The rate at which the WWW service is sending data, in bytes per second. |
Web Service\Bytes Received/sec |
The rate at which the WWW service is receiving data, in bytes per second. |
Web Service\Bytes Total/sec |
The rate at which the WWW service is sending and receiving data, in bytes per second (the sum of Web Service\Bytes Sent/sec and Web Service\Bytes Received/sec). |
FTP Service\Bytes Sent/sec |
The rate at which the FTP service is sending data, in bytes per second. |
FTP Service\Bytes Received/sec |
The rate at which the FTP service is receiving data, in bytes per second. |
FTP Service\Bytes Total/sec |
The rate at which the FTP service is sending and receiving data, in bytes per second (the sum of FTP Service\Bytes Sent/sec and FTP Service\Bytes Received/sec). |
SMTP Server\Bytes Sent/sec |
The rate at which the SMTP server is sending data, in bytes per second. |
SMTP Server\Bytes Received/sec |
The rate at which the SMTP server is receiving data, in bytes per second. |
SMTP Server\Bytes Total/sec |
The rate at which the SMTP server is sending and receiving data, in bytes per second (the sum of SMTP Service\Bytes Sent/sec and SMTP Service\Bytes Received/sec). |
Analyzing the data
The IIS 6.0 service counters listed in Table 6.5 display the number of bytes transmitted on behalf of each service that runs on the server. To calculate the total number of bytes sent or received by all IIS 6.0 services, calculate the sum of the values for each service. To determine the proportion of bytes transmitted by each service, compute the ratio of bytes for one service to the sum of bytes for all services or for the network.
Data collected by the IIS 6.0 service counters underestimates the total number of bytes that the IIS 6.0 services actually transmit to the network. Because these values are collected at the application layer, they measure data only. They do not measure protocol headers, control packets, or retransmitted bytes. In general, the bytes counted by the services represent 60 to 70 percent of the total number of bytes transmitted by the services on the network. If the sum of bytes for all services accounts for two-thirds or more of total network bandwidth, you can assume that your network is running at or near the total capacity of its communications link.
If you are using bandwidth throttling to limit the amount of bandwidth that the WWW service or an individual Web site uses, or you want to evaluate whether bandwidth throttling might be useful, monitor the Web Service\Bytes Total/sec and the Web Service\Bytes Sent/sec counters. These counters can indicate whether your Web server has sufficient bandwidth to handle its load. If it does not, consider using bandwidth throttling to redistribute network availability.
For information about using bandwidth throttling, see Throttling Bandwidth to Manage Service Availability.
Counters for Monitoring Data Transmission Rates at the Transport and Network Layers
Table 6.6 lists the counters on the TCP object. These counters monitor TCP segments — the unit of data that TCP sends down the protocol stack to IP. Windows Server 2003 provides two TCP objects, TCPv4 and TCPv6. Choose the counter that monitors the version of TCP that your server uses.
Table 6.6 Counters for Measuring Data Transmission Rates at the Transport Layer
| Object\Counter | Value |
|---|---|
TCPv4\Segments Sent/sec TCPv6\Segments Sent/sec |
The rate at which TCP segments are sent by using the TCP protocol. |
TCPv4\Segments Received/sec TCPv6\Segments Received/sec |
The rate at which TCP segments are received by using the TCP protocol. |
TCPv4\Segments/sec TCPv6\Segments/sec |
The rate at which TCP segments are sent and received by using the TCP protocol (the sum of Segments Sent/sec and Segments Received/sec). |
TCPv4\Segments Retransmitted/sec TCPv6\Segments Retransmitted/sec |
The rate at which segments are transmitted that contain one or more bytes that TCP recognizes as having been transmitted before. Segments Retransmitted/sec is a subset of Segments Sent/sec and Segments/sec. To determine the proportion of transmissions caused by failed transmission attempts, divide Segments Retransmitted/sec by Segments Sent/sec. |
Table 6.7 describes lists some of the datagram counters for the IP object. These counters monitor IP datagrams, which are the units of data that IP sends down the protocol stack to the network interface, such as a network adapter. The sum of IP\Datagrams/sec and IP\Datagrams Forwarded/sec represents the rate at which the server handles all IP datagrams.
Table 6.7 Counters for Measuring Data Transmission Rates at the Network Layer
| Object\Counter | Value |
|---|---|
IPv4\Datagrams Sent/sec IPv6\Datagrams Sent/sec |
The rate at which IP datagrams are sent to the network interfaces. This counter does not include datagrams forwarded to another server. |
IPv4\Datagrams Received/sec IPv6\Datagrams Received/sec |
The rate at which IP datagrams are received from the network interfaces. This counter does not include datagrams forwarded to another server. |
IPv4\Datagrams/sec IPv6\Datagrams/sec |
The overall transmission rate for IP datagrams being sent and received over the network interfaces (the sum of IP\Datagrams Sent/sec and IP\Datagrams Received/sec). |
IPv4\Datagrams Forwarded/sec IPv6\Datagrams Forwarded/sec |
The rate, in incidents per second, at which the server attempts to find routes over which to forward IP datagrams to their final destination. |
Analyzing the data
Counters on the TCP and IP performance objects display the rate at which data is sent and received over a TCP/IP connection at the transport and network layers, but the rate is not expressed in bytes. Counters on the IP performance object display data in datagrams, and counters on the TCP performance object display data in segments. It is difficult to convert segments to bytes because bytes per segment can vary from 8 KB to 64 KB (the size can increase to 1 gigabyte [GB] if a window scaling option is in effect), depending upon the size of the TCP/IP receive window and the maximum segment size negotiated when each connection is established.
Counters for Monitoring Data Transmission Rates at the Data-Link Layer
Table 6.8 lists several counters on the Network Interface performance object that might be useful for obtaining data about the network adapters on the server. The first instance of the Network Interface object that you see in System Monitor represents the loopback — a local path through the protocol driver and the network adapter; all other instances represent installed network adapters.
Table 6.8 Counters for Measuring Data Transmission Rates at the Data-Link Layer
| Object\Counter | Value |
|---|---|
Network Interface (Adapter ID)\Bytes Sent/sec |
The rate, in seconds, at which bytes are sent over this network adapter. The counted bytes include framing characters. This counter is a subset of Network Interface\Bytes Total/sec. |
Network Interface (Adapter ID)\Bytes Received/sec |
The rate, in seconds, at which bytes are received over this network adapter. The counted bytes include framing characters. This counter is a subset of Network Interface\Bytes Total/sec. |
Network Interface (Adapter ID)\Bytes Total/sec |
The rate, in bytes per second, at which bytes are sent and received over this network adapter (the sum of Network Interface\Bytes Sent/sec and Network Interface\Bytes Received/sec). |
Network Interface\Packets Sent/sec |
The rate, in seconds, at which packets are sent over the network adapter. |
Network Interface\Packets Received/sec |
The rate, in seconds, at which packets are received over the network adapter. |
Analyzing the data
Counters for the Network Interface performance object display the rate at which bytes are transmitted over a TCP/IP connection by monitoring the counters on the network adapter at the data-link layer. The values of these Network Interface counters include all prepended frame header bytes and bytes that have been retransmitted. They provide a relatively accurate estimate of the number of bytes transmitted over the network, but do not measure the bytes transmitted by a specific IIS 6.0 service.
It is useful to compare the data produced by these counters with other performance measures, such as the total number of connections served at a given bandwidth or processor use at different throughput rates.