Wireshark-bugs: [Wireshark-bugs] [Bug 5541] Custom Window Size Column Shows Two Values and Doesn
Date: Mon, 3 Jan 2011 22:44:48 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5541

--- Comment #8 from Stephen Fisher <[email protected]> 2011-01-03 23:44:47 MST ---
(In reply to comment #7)

> So if I understand this correctly, there will once again be only a single
> instance of tcp.window_size and it will show the correct window size whether
> scaling is used or not?

Yes.

> Does "without scaling" include the situation where Wireshark did not see the
> 3-way handshake, or does it only apply where Wireshark saw the 3-way
> handshake, and scaling was not used?

I was referring to cases where the 3-way handshake was not seen or when the
scaling option wasn't used in the 3-way handshake.  Basically: whenever
Wireshark doesn't know.

> Also, it appears to me that as part of these changes tcp.options.wscale_val 
> was renamed to tcp.options.wscale.shift.

Previous to r34094 where I made these changes, the two filters were
tcp.options.wscale (a boolean of whether the scaling option was present) and
tcp.options.wscale_val (the shift count value).

> If so, that will break some existing filters.

Yes, unfortunately Wireshark books are out of date the day they're printed... I
chose to change "wscale_val" to "wscale.shift" for clarity and add the
generated "wscale.multiplier" which was previously only a text note and not
filterable/extractable.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.