[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 29, 2003, at 1:30 PM, Yingchao Liu wrote:

> I'm trying to use ethereal to reconstruct a tcp communication.
> What I'm retrieving is the traffic of a simple web session
> initiated from mozilla in Linux to a website. I'm especially
> interested in the send window size and the receive window size
> at that certain time point for each packet.
> The segment of output is as follows. I have no clue about
> what "window size" means in the output.

It means the window size in the TCP header (what RFC 793 calls 
"Window"), scaled by the window scaling option if you have relative 
sequence numbers enabled (which you don't appear to) and if your 
capture includes a packet where window scaling is negotiated.

I.e., it's the receive window offered by the machine sending the TCP 
segment, although if window size scaling is in effect, it might not be 
the window size in bytes.

>  The "next sequence number" also seems bizarre to me.

It's the sequence number with which the next segment would start (i.e., 
current sequence number plus number of payload bytes; 3799174939 + 513 
= 3799175452).
>