Hey everyone, just wondered: if i have a TCP packet with SYN flag set, there is a window size set in the RWIN header field (e.g. 0x2000) and there might be a window scale option in the options section (eg 0x030308 --> WinScale, Len 3, shift by 8). From what I understand, RWin should be (0x2000 << 8 = 0x20000 = 2097152 Byte) in this case. However, wireshark displays: Window Size Value: 8192 [calculated window size: 8192] Window Scale: 8 (Multiply by 256) So Im wondering .. is either the value for RWin incorrect or is the RWin calculation incorrect? (or none of both and i just misunderstood something?) asked 22 Feb '17, 02:05  DemoniacMilk |
One Answer:
Please have a look here: https://ask.wireshark.org/questions/51352/window-size-value-in-the-ack-packet-of-a-syn-synack-ack-handshake?page=1&focusedAnswerId=51353#51353 Inside the SYN packet the WindowSaling is never used (RFC). So Wireshark is absolutely correct. answered 22 Feb '17, 02:36  Christian_R |
Ah thank you! So its more like "hey i would like to use window scaling if you support it" with a backwards-compatible, non-shifted window size in the header.
Yes that is true!