This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Preferences TCP - providing WindowScale factor

0

Just came across the new fantastic feature of telling wireshark what the windowscale factor was when the 3-way handshake is not captured. Edit - Preferences -> Protocols -> TCP alt text

What can I do when the window scaling factor is not the same at both ends? Looks like I can only specify one.

asked 05 Aug '13, 23:10

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%


One Answer:

2

You can not set the scaling factor differently for each direction, nor can you set it differently for multiple TCP sessions in the capture file as preferences are agnostic to specific contents of the capture file.

But in practice, the window scaling is most important in large transfers in one direction, so setting a global scaling factor to analyze one flow of the session works pretty well.

answered 05 Aug '13, 23:24

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Not what I was hoping for but thanks for the explanation! Maybe in a future release the user can add that information as a keyword in a packet comment on any 2 packets of a single tcp connection (one in every direction) for wireshark to read and process.

(07 Aug '13, 01:04) mrEEde