what is ‘WS’ ‘TSval’ and ‘SACK_PERM’ mean in packet info columns???

Question

Dear wireshark experts,

I got stuck in with some really tough questions, just as mentioned in subject. What is that???

Help!!!

8   1.253204    172.30.87.216   119.167.194.133 TCP 74  50785 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 ***SACK_PERM=1 TSval=1575384402 TSecr=0 WS=128***

So appreciated in advance!

Accepted Answer

First of all, it is not really a tough question ;-)

What you have there is a SYN packet (which is used in the TCP handshake session setup), and in that packet optional TCP parameters are given - see RFC 1323 for more details on what and why.

SACK_PERM means that the node with IP 172.30.87.216 "knows" how to work with so called "Selective Acknowledgements", as described in RFC 2018.
It also uses TCP Timestamps (TSval/TSecr), and uses a
"Window Scaling of 128, which is the result of it advertising a Scale Factor of 7 (not seen in the info column, but in the decode).

All of these are so called high performance options that are now pretty common since all modern TCP stacks know about those and use them, especially in high latency high bandwidth environments (LFN).