Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Window scaling

From: Robert Dahlem <Robert.Dahlem@xxxxxxx>
Date: Mon, 6 Jun 2016 17:45:57 +0200

On 06.06.2016 17:37, ronnie sahlberg wrote:

>> I do not agree with the statement that packets with the SYN bit set are
>> never scaled.
> 
> The standard is pretty clear for this case.

> The Window field in a SYN (i.e., a <SYN> or <SYN,ACK>) segment
> itself is never scaled.

Maybe my English is not good enough for the proper definition of
"scaled". To clarify this for me: I have a SYN/ACK packet with Window
size 8192 and Window scale 8 (multiply by 256): is the client allowed to
send 8192 or 2G bytes without seeing the first ACK without SYN from the
server?

Were it 8192 then the Linux kernel had been right in marking the packets
with more than 81902 bytes in flight as invalid.

Kind regards,
Robert