This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Just came across the new fantastic feature of telling wireshark what the windowscale factor was when the 3-way handshake is not captured. Edit - Preferences -> Protocols -> TCP alt text

What can I do when the window scaling factor is not the same at both ends? Looks like I can only specify one.

asked 05 Aug '13, 23:10

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%


You can not set the scaling factor differently for each direction, nor can you set it differently for multiple TCP sessions in the capture file as preferences are agnostic to specific contents of the capture file.

But in practice, the window scaling is most important in large transfers in one direction, so setting a global scaling factor to analyze one flow of the session works pretty well.

permanent link

answered 05 Aug '13, 23:24

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Not what I was hoping for but thanks for the explanation! Maybe in a future release the user can add that information as a keyword in a packet comment on any 2 packets of a single tcp connection (one in every direction) for wireshark to read and process.

(07 Aug '13, 01:04) mrEEde
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×39
×2

question asked: 05 Aug '13, 23:10

question was seen: 2,130 times

last updated: 07 Aug '13, 01:04

p​o​w​e​r​e​d by O​S​Q​A