Just came across the new fantastic feature of telling wireshark what the windowscale factor was when the 3-way handshake is not captured. Edit - Preferences -> Protocols -> TCP What can I do when the window scaling factor is not the same at both ends? Looks like I can only specify one. asked 05 Aug '13, 23:10  mrEEde |
One Answer:
You can not set the scaling factor differently for each direction, nor can you set it differently for multiple TCP sessions in the capture file as preferences are agnostic to specific contents of the capture file. But in practice, the window scaling is most important in large transfers in one direction, so setting a global scaling factor to analyze one flow of the session works pretty well. answered 05 Aug '13, 23:24  SYN-bit ♦♦ |
Not what I was hoping for but thanks for the explanation! Maybe in a future release the user can add that information as a keyword in a packet comment on any 2 packets of a single tcp connection (one in every direction) for wireshark to read and process.