Hi All, I am capturing a network traces for one of my problem debugging.I see that Window size is shown as "70145(scaled)" as soon as I start my application.but after some time it shows me the value of only "1525". can anyone please help me understand why it is falling to that value.Also why it is not showing "scaled" in after few minutes of restarting the window. Window scaling is on in my machine with value set as 1. Thanks, Parveen Jain asked 16 Aug '11, 00:29  pjain |
One Answer:
Hi Parveen, I seems that you may be capturing multiple TCP sessions, but have only seen the initialization of one of them. If you capture the three-way handshake then WireShark will be aware of the endpoints' use of Window Scaling and will calculate the actual window size, and add "(scaled)" to the it. If you don't capture the three-way handshake then WireShark will just read the bits in the Options field. If you looked at the individual packet that has "70145(scaled)" as the window size, and looked at the actual bits you'd see that it probably lists something similar to the other packets (ie: 1525). John answered 16 Aug '11, 11:33  GeonJay |
