This is our old Q&A Site. Please post any new questions and answers at

Dear wireshark experts,

I got stuck in with some really tough questions, just as mentioned in subject. What is that???


8   1.253204 TCP 74  50785 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 ***SACK_PERM=1 TSval=1575384402 TSecr=0 WS=128***

So appreciated in advance!

asked 04 Nov '11, 03:56

wenchao_wang's gravatar image

accept rate: 0%

edited 04 Nov '11, 03:57

grahamb's gravatar image

grahamb ♦

First of all, it is not really a tough question ;-)

What you have there is a SYN packet (which is used in the TCP handshake session setup), and in that packet optional TCP parameters are given - see RFC 1323 for more details on what and why.

  • SACK_PERM means that the node with IP "knows" how to work with so called "Selective Acknowledgements", as described in RFC 2018.
  • It also uses TCP Timestamps (TSval/TSecr), and uses a
  • "Window Scaling of 128, which is the result of it advertising a Scale Factor of 7 (not seen in the info column, but in the decode).

All of these are so called high performance options that are now pretty common since all modern TCP stacks know about those and use them, especially in high latency high bandwidth environments (LFN).

permanent link

answered 04 Nov '11, 04:10

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

edited 17 Jul '12, 13:48

Guy%20Harris's gravatar image

Guy Harris ♦♦

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 Nov '11, 03:56

question was seen: 34,504 times

last updated: 17 Jul '12, 13:48

p​o​w​e​r​e​d by O​S​Q​A