Wireshark · Wireshark-users: Re: [Wireshark-users] TCP: window scaling

["Jo Verstraelen" <J.Verstraelen@xxxxxxxxxx>]

Sake,

 

That explains…
But that doesn’t change the fact that it is bizar, because the destination ip of the server in the pcap file is a webserver of the Mozilla corp. So a 100MBit+ webserver that does not support window scaling?

 

Thanks for the info,

jo

 

---

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Sake Blok
Sent: maandag 23 maart 2009 13:18
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] TCP: window scaling

 

Jo,

 

Both ends of the tcp connection need to support Window scaling for it to be used:

 

"This option is an offer, not a promise; both sides must send Window Scale options in their SYN segments to enable window scaling in either direction."

(From http://tools.ietf.org/html/rfc1323)

 

In your trace, host 63.245.209.93 does not support Window scaling, as the SYN/ACK that it sends does not have the window scaling option. Therfore no window scaling will be used and Wireshark displays non-scaled values.

 

Hope this helps,

Cheers,

     Sake

----- Original Message -----

From: Jo Verstraelen

To: Community support list for Wireshark

Sent: Monday, March 23, 2009 11:58 AM

Subject: Re: [Wireshark-users] TCP: window scaling

 

Hi Sake,

 

Here you go: http://denuitlaat.be/tcp/windowscaled1.pcap .
It shows that a session is started with a SYN and the option ws is present (ws = 2). The segments following do not show a scaled window size.

 

Regards,

jo

 

---

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Sake Blok
Sent: maandag 23 maart 2009 11:40
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] TCP: window scaling

 

Hi Jo,

 

The window size should consistently be displayed within one TCP session. Between sessions, there could be difference, because either there is no scaling, or the SYN, SYN/ACK were not present in the tracefile. If that does not explain the differences you see, could you provide a small capture showing this issue?

 

Cheers,

Sake

 

----- Original Message -----

From: Jo Verstraelen

To: wireshark-users@xxxxxxxxxxxxx

Sent: Monday, March 23, 2009 11:03 AM

Subject: [Wireshark-users] TCP: window scaling

 

Hi,

 

Is there a reason why sometimes in a connection which received a window scaler (syn;syn,ack) , the window size is

shown as “number (scaled)” and sometimes just as “number” (non scaled) in the next segments. Cause in the last case its not

possible to know the exact window size as the window scale factor is non present in the segments after the syn; syn,ack.

Kind regards,

Jo

 

 

---

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

---

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe