Re: About window scale option

[Jeff Morriss <jeff.morriss.ws () gmail com>]

On 10/28/14 11:12, 徐鸿 wrote:
> Hi ,
>
>     If the server does not support 'Window Scale' option, even the
> client send one packet with WS=256,  I thought the real window size
> should be consider small than 64K.    But I can see the 'Calculated
> window size' is larger that 64K on Wireshark1.12.1, is there something
> wrong ?   the trace file is attached.

Well remember that on a given TCP connection there are 2 window sizes: 
that of the client and that of the server.

In this trace the client supports scaling but the server does not. 
Wireshark (at least the development version I just tried) correctly 
applied scaling to the client's window but not to the server's window:

> > ./tshark -Y "ip.src==192.168.1.200" -Vr /tmp/window_scale_neg.pcapng |grep -i "window size"
>     Window size value: 8192
>     [Calculated window size: 8192]
>     Window size value: 64952
>     [Calculated window size: 16627712] <<< Scaling applied
>     [Window size scaling factor: 256]
>     Window size value: 64952
>     [Calculated window size: 16627712]
>     [Window size scaling factor: 256]
>     Window size value: 64222
>     [Calculated window size: 16440832]
>     [Window size scaling factor: 256]
>     Window size value: 64222
>     [Calculated window size: 16440832]
>     [Window size scaling factor: 256]
> > ./tshark -Y "ip.dst==192.168.1.200" -Vr /tmp/window_scale_neg.pcapng |grep -i "window size"
>     Window size value: 14600
>     [Calculated window size: 14600]
>     Window size value: 11256
>     [Calculated window size: 11256] <<< No Scaling applied
>     [Window size scaling factor: -2 (no window scaling used)]
>     Window size value: 11256
>     [Calculated window size: 11256]
>     [Window size scaling factor: -2 (no window scaling used)]
>     Window size value: 11256
>     [Calculated window size: 11256]
>     [Window size scaling factor: -2 (no window scaling used)]
>     Window size value: 11256
>     [Calculated window size: 11256]
>     [Window size scaling factor: -2 (no window scaling used)]


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe