Wireless – How to capture packets from all wifi channels at once

In the scenario you describe, you should definitely be looking at multiple access points, preferrably dual band APs.

While coverage may be sufficient, coverage alone is no longer the primary consideration when deploying a wirelss network. Client capacity, channel utilization, signal quality, and reliability are much more important and multiple access points will help with all of these.

By using 3 (or more) APs on multiple channels (1, 6, and 11), you will in effect triple the amount of airtime (bandwidth) available on your wireless network.

Additionally, proper placement of the APs will provide clients a closer AP with stronger signal, which will be more resistant to noise in the RF environment. This will allow better signal-to-noise (SNR) ratios which will translate to the use of higher data rates and this results in more data transmitted per "timeslot".

I would recommend placing them 2/3 to 3/4 of the way from the center to the perimeter, spaced roughly evenly. Try to get them in or as close to the highest user denisity locations as possible (i.e. conference rooms, etc).

Finally, the additional access points will provide increased reliability. With a single access point, if it were to fail or reboot for any reason, this would create a disruption in service. Having multiple access points should allow for coverage to overlap, allowing service to remain (if degraded) when you have an access point down.

Well. Since you've captured packets that show that your Trading Server is sending the TCP ACK's with a window size of 0, you at least know the problem is definitely on your side. Which is actually a good thing, because you are in a position to fix it. (There is one thing that might be the issue which would be a problem on their end, I'll talk about that later)

You've also traced the issue to happening during times of increased throughput, also a good thing.

You said the CPU/RAM usage on your Trading Server reported normal. The application you are using, is it by chance configured to use a limited amount of RAM on the host OS? Maybe a limited percent? Because it would stand to reason that if so, as you had more connections and more throughput, there was less RAM available to the application, and therefore less resources available for TCP.

Either way, what OS is your Trading Server using? If you haven't already, you should look into tuning the OS to dedicate more RAM to TCP. In Windows, there are Registry values you can modify. In Linux, there are config files you can edit.

It would also be wise to make sure your Firewall (and nothing else in between) is trying to proxy your TCP sessions. That way you know you are dealing with the full "client to server" TCP connection, and not something in between.

The last thing I can offer is to study the TCP packets being sent from the Stock Exchange to your server just before your server sends a Window Size of 0. In particular, look for the incoming packets to have the value 11 in the IP Header's ECN field (Explicit Congestion Notification -- the last two bits in what used to be DSCP, bits 14 and 15 if you're looking at an IP Header). There is a chance that if both the Client and Server in the communication supported ECN, and a router in transit detected congestion, that it turned these bits on to tell the client and server to slow down their transfers. (This is that thing I said that might be a problem on their end)

I think that (tries to) answer questions 0,1,3. I'll have to dig around a bit more to give you a reliable answer for 2. But I'm pretty confident there is a way.