TCP Zero Window Appears in Packet Capture
This means that the client cannot receive any more information at this time, and the TCP transmission will be paused until it can process the information in its receive buffer.
The TCP window size is the amount of information the computer can receive during TCPSession and still be able to process the data. Think of it like a TCP receive buffer. When a machine initiates a TCP connection to a server, it lets the server know how much data it can receive via the window size.
In many Windows machines, this value is approximately 64512 bytes. When TCPSession starts and the server starts sending data, the client will reduce its window size as this buffer fills. At the same time, the client is processing the data in the buffer and clearing it to make room for more data. Through the TCP ACK frame, the client informs the server how much space is in this buffer. If the TCP window size drops to 0, the client will no longer be able to receive any data until it processes and opens the buffer again. In this case, wireshark will indicate "zero window" in the packet capture file.
Zero Window Troubleshooting For one reason or another, the machine that prompts zero window will no longer receive any data from Host. It could be that the machine is running too many processes at the time and its processor is full. Or maybe Error is present in the TCP receiver.