Wireshark-users: Re: [Wireshark-users] TCP: window scaling
From: "Jo Verstraelen" <[email protected]>
Date: Mon, 23 Mar 2009 11:58:54 +0100

Hi Sake,


Here you go: http://denuitlaat.be/tcp/windowscaled1.pcap .
It shows that a session is started with a SYN and the option ws is present (ws = 2). The segments following do not show a scaled window size.





From: wireshark-u[email protected] [mailto:[email protected]] On Behalf Of Sake Blok
Sent: maandag 23 maart 2009 11:40
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] TCP: window scaling


Hi Jo,


The window size should consistently be displayed within one TCP session. Between sessions, there could be difference, because either there is no scaling, or the SYN, SYN/ACK were not present in the tracefile. If that does not explain the differences you see, could you provide a small capture showing this issue?





----- Original Message -----

Sent: Monday, March 23, 2009 11:03 AM

Subject: [Wireshark-users] TCP: window scaling




Is there a reason why sometimes in a connection which received a window scaler (syn;syn,ack) , the window size is

shown as “number (scaled)” and sometimes just as “number” (non scaled) in the next segments. Cause in the last case its not

possible to know the exact window size as the window scale factor is non present in the segments after the syn; syn,ack.

Kind regards,




Sent via:    Wireshark-users mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:[email protected]?subject=unsubscribe