This is our old Q&A Site. Please post any new questions and answers at

Hey everyone,

just wondered: if i have a TCP packet with SYN flag set, there is a window size set in the RWIN header field (e.g. 0x2000) and there might be a window scale option in the options section (eg 0x030308 --> WinScale, Len 3, shift by 8). From what I understand, RWin should be (0x2000 << 8 = 0x20000 = 2097152 Byte) in this case. However, wireshark displays:

Window Size Value: 8192

[calculated window size: 8192]

Window Scale: 8 (Multiply by 256)

So Im wondering .. is either the value for RWin incorrect or is the RWin calculation incorrect? (or none of both and i just misunderstood something?)

asked 22 Feb '17, 02:05

DemoniacMilk's gravatar image

accept rate: 0%

Please have a look here: Inside the SYN packet the WindowSaling is never used (RFC). So Wireshark is absolutely correct.

permanent link

answered 22 Feb '17, 02:36

Christian_R's gravatar image

accept rate: 16%

Ah thank you! So its more like "hey i would like to use window scaling if you support it" with a backwards-compatible, non-shifted window size in the header.

(22 Feb '17, 06:33) DemoniacMilk

Yes that is true!

(22 Feb '17, 06:53) Christian_R
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 Feb '17, 02:05

question was seen: 1,631 times

last updated: 22 Feb '17, 06:53

p​o​w​e​r​e​d by O​S​Q​A