I am new to Wireshark but trying to learn : ) I created a column to display Windows size but after some time I noticed the Windows size being reported was very low e.g 258. After looking through the byte details I can see there is also an [estimated windows size] which is far greater. Is this estimated Windows size Wireshark taking the 258 and multiplying it by what ever Windows scaling is employed or is it something else? Thanks asked 05 Mar '15, 13:47 Costello |
One Answer:
Yes, correct, you're seeing the 16 bit window value of 258, but it gets multiplied by the scale factor. It's better to look at the calculated window size, because that's the "real" window size. Keep in mind that this only works if the conversation was captured including the three way handshake, because that's where the scale factor is set - if you miss the handshake, you (and Wireshark) don't know the multiplier. answered 05 Mar '15, 14:01 Jasper ♦♦ |
Great, thank you very much