I am doing a TCP evaluation and i am confused with the value of MSS (maximum segment size) i am getting on Wireshark. When i capture the traffic using Wireshark, it only shows the value of MSS as 1460 in few packets but shows NULL for many of the packets. Why do you think is that I am getting a NULL value for MSS? How can fix this problem? asked 14 Feb '17, 13:35  armodes edited 26 Feb '17, 06:57 |
2 Answers:
Maximum Segment Size is a TCP option where a TCP peer announces to the other TCP peer the maximum size TCP data segment that it can receive. The MSS option is found only in the SYN and SYN/ACK packets of the TCP connection establishment three-way handshake. In your trace, MSS is present only in packets 1, 2, 16, 17, 191,897, and 191,898, and in every one of those packets, the MSS is 1460. Where do you think you are seeing an MSS NULL value? If you're talking about packets with "Len=0" in the Info column, that is not the maximum segment size, that's the size of the actual data segment in those packets. TCP packets with no data are mostly acknowledgements. Your image link still does not work. answered 14 Feb '17, 18:44  Jim Aragon |
I don't know what software generated that table, but it's showing one row for every packet, and, for every packet that doesn't have a TCP Maximum Segment Size option - i.e., for most packets in a TCP connection - it's showing NULL rather than just an empty column. There's nothing to fix - most of those packets don't have the MSS option, because the MSS is established when the connection is set up and not changed after that - so it's not supposed to show an MSS option because there isn't one to show. answered 15 Feb '17, 16:52  Guy Harris ♦♦ |
The link takes one to a page with a prompt to "Upload and share your images" and buttons to login or to create an account, but there is nothing to download.
Also, if the link is to a screenshot, it would be much better to post an actual trace file, anonymized if necessary.
I have fixed the URL now but how can i post the whole actual trace file?
You can share a capture in a publicly accessible spot, e.g. CloudShark, Google Drive, Dropbox etc.