This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Windows size question

0

I am new to Wireshark but trying to learn : ) I created a column to display Windows size but after some time I noticed the Windows size being reported was very low e.g 258. After looking through the byte details I can see there is also an [estimated windows size] which is far greater. Is this estimated Windows size Wireshark taking the 258 and multiplying it by what ever Windows scaling is employed or is it something else? Thanks

asked 05 Mar '15, 13:47

Costello's gravatar image

Costello
30448
accept rate: 0%


One Answer:

1

Yes, correct, you're seeing the 16 bit window value of 258, but it gets multiplied by the scale factor. It's better to look at the calculated window size, because that's the "real" window size. Keep in mind that this only works if the conversation was captured including the three way handshake, because that's where the scale factor is set - if you miss the handshake, you (and Wireshark) don't know the multiplier.

answered 05 Mar '15, 14:01

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Great, thank you very much

(05 Mar '15, 14:56) Costello