This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am new to Wireshark but trying to learn : ) I created a column to display Windows size but after some time I noticed the Windows size being reported was very low e.g 258. After looking through the byte details I can see there is also an [estimated windows size] which is far greater. Is this estimated Windows size Wireshark taking the 258 and multiplying it by what ever Windows scaling is employed or is it something else? Thanks

asked 05 Mar '15, 13:47

Costello's gravatar image

Costello
30448
accept rate: 0%


Yes, correct, you're seeing the 16 bit window value of 258, but it gets multiplied by the scale factor. It's better to look at the calculated window size, because that's the "real" window size. Keep in mind that this only works if the conversation was captured including the three way handshake, because that's where the scale factor is set - if you miss the handshake, you (and Wireshark) don't know the multiplier.

permanent link

answered 05 Mar '15, 14:01

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Great, thank you very much

(05 Mar '15, 14:56) Costello
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×254
×28

question asked: 05 Mar '15, 13:47

question was seen: 1,070 times

last updated: 05 Mar '15, 14:56

p​o​w​e​r​e​d by O​S​Q​A