hi guys, i captured a trace while accessing a web page and there's one thing that i don't understand. in the first SYN sent from my station to the web server i see a 8192 bytes Window Size and 140 MSS. in the SYN,ACK from the web server WS=65535 and MSS=1452. The ACK from my station advertises it's WS now to = 4356 and right after the ACK i receive an TCP Window Update from the web server with a WS of 2064 ???? why such a big decrease if no actual data has been transferred yet? asked 12 Mar '15, 15:37 adasko |
One Answer:
Lower window sizes conserve memory, so an operating systems may decide to use small sizes. And as long as it doesn't prevent the sender from continuing to send more data, it's not a problem. answered 12 Mar '15, 20:57 Jasper ♦♦ |