The tcp.window_size_value is the raw window size value as read directly from the TCP header, whereas tcp.window_size is the calculated window size, which is based on whether window scaling is applicable or not. If window scaling is not used or the scaling factor is 1 or if it's unknown whether window scaling is applicable or not because the TCP 3-way handshake was not captured, then the two values will be the same. You can tell by the tcp.window_size_scalefactor which of these conditions is applicable - if its value is -1, then it's unknown, if its value is -2, then window scaling is not used, and all other values represent an actual window scaling size factor.
For more information on the TCP window scale option, refer to RFC 1323 and/or RFC 7323, which obsoletes RFC 1323.
answered 02 Mar '17, 10:01
cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%
Which one has an impact on the congestion window (cwnd)?
the calculated window size, because that's how big the window really is.
As the cwnd is a stack internal value wihich says how much data can be sent the size can only be guessed. The value which helps you here Ivan be in some cases the "bytes in flight".
In fact the limitations for the session are the minimum value of the cwnd or the calculated window size, depends on which value is smaller.