Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] TCP ZeroWindowProbe problem / question

From: "ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>
Date: Tue, 20 Feb 2007 20:27:47 +0000
On 2/20/07, Ulf Lamping <ulf.lamping@xxxxxx> wrote:

Interestingly, the effect I saw is that the window size is zero before
and after the probe byte, although the receiver actually ACK'ed the
"probe byte".

Do you use window scaling?
If you have window scaling the most likely explanation for your
observation is that the window is not really 0 but smaller than the
scaling factor.

I.e. assume the window is 7 bytes in size  but you have a window scale
factor of 8.
Since 7/8 is 0,  zero is what will be advertized.