George Vandelet wrote:
> Wireshark superusers,
>
> I have been looking at captures and many times I see at the end of an TCP HTTP
> session a TCP packet (or series of TCP packets) that looks to (in wireshark)
> change the window size. Why does wireshark show that the window size changes
> right before the TCP session is closed? It does not make sense to change the
> window size after the first FIN,ACK ->ACK exchange has been done as there is
> nothing to do after that except for close the connection with the following
> FIN,ACK ->ACK!
Just because one end has sent a FIN it does not mean the other end has
finished sending. A half-close causes a FIN, but does not stop the
program from reading data coming back.
Hence reporting window size changes is still appropriate.
--
There's no point in being grown up if you can't be childish sometimes.
-- Dr. Who