This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

hi guys,

i captured a trace while accessing a web page and there's one thing that i don't understand.

in the first SYN sent from my station to the web server i see a 8192 bytes Window Size and 140 MSS. in the SYN,ACK from the web server WS=65535 and MSS=1452.

The ACK from my station advertises it's WS now to = 4356 and right after the ACK i receive an TCP Window Update from the web server with a WS of 2064 ????

why such a big decrease if no actual data has been transferred yet?

asked 12 Mar '15, 15:37

adasko's gravatar image

adasko
86343842
accept rate: 0%


Lower window sizes conserve memory, so an operating systems may decide to use small sizes. And as long as it doesn't prevent the sender from continuing to send more data, it's not a problem.

permanent link

answered 12 Mar '15, 20:57

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×55
×41

question asked: 12 Mar '15, 15:37

question was seen: 1,369 times

last updated: 12 Mar '15, 20:57

p​o​w​e​r​e​d by O​S​Q​A