https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5541
--- Comment #8 from Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx> 2011-01-03 23:44:47 MST ---
(In reply to comment #7)
> So if I understand this correctly, there will once again be only a single
> instance of tcp.window_size and it will show the correct window size whether
> scaling is used or not?
Yes.
> Does "without scaling" include the situation where Wireshark did not see the
> 3-way handshake, or does it only apply where Wireshark saw the 3-way
> handshake, and scaling was not used?
I was referring to cases where the 3-way handshake was not seen or when the
scaling option wasn't used in the 3-way handshake. Basically: whenever
Wireshark doesn't know.
> Also, it appears to me that as part of these changes tcp.options.wscale_val
> was renamed to tcp.options.wscale.shift.
Previous to r34094 where I made these changes, the two filters were
tcp.options.wscale (a boolean of whether the scaling option was present) and
tcp.options.wscale_val (the shift count value).
> If so, that will break some existing filters.
Yes, unfortunately Wireshark books are out of date the day they're printed... I
chose to change "wscale_val" to "wscale.shift" for clarity and add the
generated "wscale.multiplier" which was previously only a text note and not
filterable/extractable.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.