https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5541
--- Comment #1 from Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx> 2011-01-01 21:47:38 MST ---
(In reply to comment #0)
> Shouldn't the two window size fields be identified by different field names so
> that they can be filtered on or added to custom columns independently? This
> would also correct the sorting issue.
This was a judgment call on my part when improving the display of the window
sizes recently. It is only possible to show the scaled window size if the
3-way handshake for the TCP stream is in the current capture session/file. The
preferences have also have to be enabled (the default; but it can be disabled
by turning off "window scaling" and/or "analyze TCP sequence numbers" in the
TCP protocol's preferences.) Since the user of Wireshark may not realize if
these requirements are met, they won't know whether to use the display filter
for the scaled or normal window size.
You can use the "field occurrence" setting when adding custom columns to make
it show only the first (always the actual value from packet) or second (always
the scaled value or blank if it can't be computed) by changing field occurence
from "0" (all occurrences) to "1" or "2".
I also changed it to show the window size value from the packet on every packet
and then show the scaled value (a multiple of the packet's value known only
from the 3-way handshake earlier) for clarity in understanding how the TCP
protocol works.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.