Hopefully someone can help me understand what I'm seeing here.
- A client Syn goes out with a window size of 8190 and no scaling factor.
- Syn/ACK from server with a window size of 8192 and no scaling factor.
- Client piggybacks the ACK with data, but suddenly the window size is 64240.
- Server sends data and suddenly it's window size is 64240.
I don't understand how the window size can change so drastically when initial size is 8K and no scaling is enabled. Any insight is greatly appreciated.
No. Time TCPStrmDelta Source Destination Protocol Stream SeQ nSeQ ACK TCP Len B-flight Length Flags Window Size Info
10528 181.247065 0.000000000 172.22.0.196 172.22.0.201 TCP 159 0 0 0 60 0x0002 8190 63973→443 [SYN] Seq=0 Win=8190 Len=0 MSS=1460
Frame 10528: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: 92:69:13:b7:6d:b0 (92:69:13:b7:6d:b0), Dst: Vmware_98:6a:14 (00:50:56:98:6a:14)
Internet Protocol Version 4, Src: 172.22.0.196 (172.22.0.196), Dst: 172.22.0.201 (172.22.0.201)
Transmission Control Protocol, Src Port: 63973 (63973), Dst Port: 443 (443), Seq: 0, Len: 0
Source Port: 63973 (63973)
Destination Port: 443 (443)
[Stream index: 159]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number)
Acknowledgment number: 0
Header Length: 24 bytes
…. 0000 0000 0010 = Flags: 0x002 (SYN)
Window size value: 8190
[Calculated window size: 8190]
Checksum: 0x2f91 [validation disabled]
Urgent pointer: 0
Options: (4 bytes), Maximum segment size
Maximum segment size: 1460 bytes
[Timestamps]
No. Time TCPStrmDelta Source Destination Protocol Stream SeQ nSeQ ACK TCP Len B-flight Length Flags Window Size Info
10529 181.247170 0.000105000 172.22.0.201 172.22.0.196 TCP 159 0 1 0 60 0x0012 8192 443→63973 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460
Frame 10529: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: Vmware_98:6a:14 (00:50:56:98:6a:14), Dst: 92:69:13:b7:6d:b0 (92:69:13:b7:6d:b0)
Internet Protocol Version 4, Src: 172.22.0.201 (172.22.0.201), Dst: 172.22.0.196 (172.22.0.196)
Transmission Control Protocol, Src Port: 443 (443), Dst Port: 63973 (63973), Seq: 0, Ack: 1, Len: 0
Source Port: 443 (443)
Destination Port: 63973 (63973)
[Stream index: 159]
[TCP Segment Len: 0]
Sequence number: 0 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
Header Length: 24 bytes
…. 0000 0001 0010 = Flags: 0x012 (SYN, ACK)
Window size value: 8192
[Calculated window size: 8192]
Checksum: 0xf8ce [validation disabled]
Urgent pointer: 0
Options: (4 bytes), Maximum segment size
Maximum segment size: 1460 bytes
[SEQ/ACK analysis]
[Timestamps]
No. Time TCPStrmDelta Source Destination Protocol Stream SeQ nSeQ ACK TCP Len B-flight Length Flags Window Size Info
10530 181.247194 0.000024000 172.22.0.196 172.22.0.201 TLSv1 159 1 113 1 112 112 166 0x0018 64240 Client Hello
Frame 10530: 166 bytes on wire (1328 bits), 166 bytes captured (1328 bits) on interface 0
Ethernet II, Src: 92:69:13:b7:6d:b0 (92:69:13:b7:6d:b0), Dst: Vmware_98:6a:14 (00:50:56:98:6a:14)
Internet Protocol Version 4, Src: 172.22.0.196 (172.22.0.196), Dst: 172.22.0.201 (172.22.0.201)
Transmission Control Protocol, Src Port: 63973 (63973), Dst Port: 443 (443), Seq: 1, Ack: 1, Len: 112
Source Port: 63973 (63973)
Destination Port: 443 (443)
[Stream index: 159]
[TCP Segment Len: 112]
Sequence number: 1 (relative sequence number)
[Next sequence number: 113 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header Length: 20 bytes
…. 0000 0001 1000 = Flags: 0x018 (PSH, ACK)
Window size value: 64240
[Calculated window size: 64240]
[Window size scaling factor: -2 (no window scaling used)]
Checksum: 0x26cb [validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
[Timestamps]
Secure Sockets Layer
No. Time TCPStrmDelta Source Destination Protocol Stream SeQ nSeQ ACK TCP Len B-flight Length Flags Window Size Info
10531 181.247636 0.000442000 172.22.0.201 172.22.0.196 TLSv1 159 1 146 113 145 145 199 0x0018 64240 Server Hello, Change Cipher Spec, Encrypted Handshake Message
Frame 10531: 199 bytes on wire (1592 bits), 199 bytes captured (1592 bits) on interface 0
Ethernet II, Src: Vmware_98:6a:14 (00:50:56:98:6a:14), Dst: 92:69:13:b7:6d:b0 (92:69:13:b7:6d:b0)
Internet Protocol Version 4, Src: 172.22.0.201 (172.22.0.201), Dst: 172.22.0.196 (172.22.0.196)
Transmission Control Protocol, Src Port: 443 (443), Dst Port: 63973 (63973), Seq: 1, Ack: 113, Len: 145
Source Port: 443 (443)
Destination Port: 63973 (63973)
[Stream index: 159]
[TCP Segment Len: 145]
Sequence number: 1 (relative sequence number)
[Next sequence number: 146 (relative sequence number)]
Acknowledgment number: 113 (relative ack number)
Header Length: 20 bytes
…. 0000 0001 1000 = Flags: 0x018 (PSH, ACK)
Window size value: 64240
[Calculated window size: 64240]
[Window size scaling factor: -2 (no window scaling used)]
Checksum: 0x9dc5 [validation disabled]
Urgent pointer: 0
[SEQ/ACK analysis]
[Timestamps]
Secure Sockets Layer
asked 02 Oct ‘14, 09:46
dsuida
46●6●7●10
accept rate: 0%
edited 02 Oct ‘14, 09:50
Jasper ♦♦
23.8k●5●51●284
Sorry about the formatting of the dissected packets. Looked good in the draft and then got all mushed together when I published it.
text dumps are always hard to read. I reformatted your quote to make it a little easier, but if you can, post the trace on http://www.cloudshark.org. Use TraceWrangler (http://www.tracewrangler.com) in case you need to sanitize it first.
Use the “Code Sample” button on the selected text to format it a little better.
However, text output analysis is never fun, its much easier for folks to assist if you share an actual capture of the traffic as they can then use the tool they know best, Wireshark :-)