TCP Excessive Zero Windows
When a TCP station communicates with another station, a window value is sent as an indication of the amount of data the sending station is willing to take for the next packet. If the sending station advertises a zero window, it is an indication that the station is unable to process any addition data at this time. The event is displayed when the percentage of zero window packets (by application and address pair) is above the critical value set in the Expert Thresholds. This value is the sum of all identified events in the TCP Events display.
Possible reasons for the event:
The system advertising the zero window is too busy to process any more data.
The system advertising the zero window TCP/IP stack is misconfigured (only an issue on older systems - modern Windows systems automatically configure enough network buffers to accommodate TCP traffic).
An application is so slow that it can not keep up with the data stream from the network, or is waiting for another event to occur.
A mismatch between sending and receiving station processing ability