This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

small window size

0

https://www.cloudshark.org/captures/999d10324330

why are the windows sizes small in the capture, between the two servers, the communication between the same server 10.87.89.100 the windows size is 64k, and it is a VM 172.255.177 is a Salaris box

asked 15 May '14, 11:29

ejohnson7's gravatar image

ejohnson7
119912
accept rate: 0%


One Answer:

1

The trace did not capture the 3-way handshake so wireshark and we don't know what the window-scaling factor is that the windows client was offering. The maximum advertized windowsize offered in the TCP header is 513 which is clearly NOT the real windowsize. Take another trace showing a SYN packet from the client, then you know what the window_scaling factor is. You can set the window_scaling factor if it is unknown under Edit - Preferences - Protocol - TCP to instruct wireshark to calculate the correct tcp.window_size.

answered 15 May '14, 13:43

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%