I understand that "TCP Full Window" indicates that the sender is sending more data than receiver's advertised window size? But why would this happen? Shouldn't the sender just be able to send data <= receiver's window?
Or is it because wireshark see more data has been queued at the sender side? But how does wireshark know this? send buffer?
asked 09 Sep '13, 22:30
That message is just an informational message of Wireshark, that it has seen a full window (exactly the 'allowed' amount of data). There is no problem (from a analysts perspective), unless there is no [TCP ZeroWindow] or a [TCP Window Update] from the client, after Wireshark has seen the [TCP Window Full].
answered 10 Sep '13, 00:08
Kurt Knochner ♦
edited 10 Sep '13, 00:09