I keep seeing what seems to be conflicting explanation for how to interpret TCP Window Scaling option in WS. I am writing a report on the what appears to be poor TCP performance. I need a warm fuzzy... My questions is this... Scenario: During TCP session establishment I typically see Win=8192 ** WS=256. 1). Which is the correct way to interpret this? NOTE: Sometimes I will see small values vice 256 [8] WS=4 WRT (-1, 0 - 14) 8192 * 8 = 65536 or 8192 * 256 = 2,097,152? It would seem that the standard 64k Windows TCP Window size fit known conventions...however the purpose of TCP Windows Scaling it to allow window sizes to open up for large bandwidth segments up to 1Gbits The confusing part is for example, I am looking at a file upload on our organizational intranet and what I see an average windows size of 920,951 Bytes; this includes sizes ranging from 138,752 to 953344. The majority of TCP window Updates indicate 953344. Thanks in advance, Fritz A few Refs: http://slaptijack.com/system-administration/what-is-tcp-window-scaling/ http://kb.pert.geant.net/PERTKB/WindowScalingOption asked 27 Aug '15, 05:01  fritzbied converted to question 27 Aug '15, 05:36  grahamb ♦ |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
O.K. and what exactly does confuse you in that example? Looks totally normal to me.