On 10/28/14 11:12, 徐鸿 wrote:
Hi ,
If the server does not support 'Window Scale' option, even the
client send one packet with WS=256, I thought the real window size
should be consider small than 64K. But I can see the 'Calculated
window size' is larger that 64K on Wireshark1.12.1, is there something
wrong ? the trace file is attached.
Well remember that on a given TCP connection there are 2 window sizes:
that of the client and that of the server.
In this trace the client supports scaling but the server does not.
Wireshark (at least the development version I just tried) correctly
applied scaling to the client's window but not to the server's window:
> ./tshark -Y "ip.src==192.168.1.200" -Vr /tmp/window_scale_neg.pcapng |grep -i "window size"
Window size value: 8192
[Calculated window size: 8192]
Window size value: 64952
[Calculated window size: 16627712] <<< Scaling applied
[Window size scaling factor: 256]
Window size value: 64952
[Calculated window size: 16627712]
[Window size scaling factor: 256]
Window size value: 64222
[Calculated window size: 16440832]
[Window size scaling factor: 256]
Window size value: 64222
[Calculated window size: 16440832]
[Window size scaling factor: 256]
> ./tshark -Y "ip.dst==192.168.1.200" -Vr /tmp/window_scale_neg.pcapng |grep -i "window size"
Window size value: 14600
[Calculated window size: 14600]
Window size value: 11256
[Calculated window size: 11256] <<< No Scaling applied
[Window size scaling factor: -2 (no window scaling used)]
Window size value: 11256
[Calculated window size: 11256]
[Window size scaling factor: -2 (no window scaling used)]
Window size value: 11256
[Calculated window size: 11256]
[Window size scaling factor: -2 (no window scaling used)]
Window size value: 11256
[Calculated window size: 11256]
[Window size scaling factor: -2 (no window scaling used)]