On 26 apr 2012, at 23:58, <Tim.Poth@xxxxxxxxxxx> <Tim.Poth@xxxxxxxxxxx> wrote:
>> At least one user was confused by that entry:
>>
>> http://ask.wireshark.org/questions/10466/window-size-scaling-factor-unknown
>>
>> Is it useful at all? If so, how would it be best rewritten so that it doesn't imply anything other than "the capture doesn't contain enough information for Wireshark to know the scaling factor", with no implication that this is a network problem?
> I like having it there
Me too... but of course I do, as I introduced it :-)
> I don't have a proble with how its worded but would this be clearer?
> Window size scaling factor: unknown (start of session not captured)
I like that idea. Should we completely drop the output of the field value when it is -1 or -2 and let users figure out the value for themselves when using "Apply as filter"? This would result in:
"Window size scaling factor: unknown, start of session not captured"
"Window size scaling factor: no window scaling used"
Or would it be better to include the artificial value:
"Window size scaling factor: -1 (unknown, start of session not captured)"
"Window size scaling factor: -2 (no window scaling used)"
Or maybe like this:
"Window size scaling factor: unknown, start of session not captured (-1)"
"Window size scaling factor: no window scaling used (-2)"
I tend to like the first option best as it does not confuse the user with a fabricated value. People that want to use this as a filter will find out the value by using any of the "... as filter" options.
Any objections?
Cheers,
Sake