 | 1 | initial version |
Hi,
It would be nice to have actual trace file to explain it to you better.
There are several things to consider.
1) Do you mean [Window Full] warning? If yes - this is not receiver's message, but comes from Wireshark itself. All receiver can do to stop transmitting is advertising Zero Window.
2) Capture point is very important to keep in mind. I suspect this capture was done on sender side.
So, here you have to remember that some amount of sent data is still on the wire "flying" to receiver. The sender calculates this value (Bytes_Sent minus Bytes_ACKed). You can find amount on data in flight by plotting "Bytes in flight" Wireshark field.
I assume including these last 60 Bytes there are exactly 256256 Bytes in Flight.
So, Wireshark sees: when all the data already been sent (but not yet ACKed) will come to receiver, it will occupy all RWIN. So, Wireshark issues "Window Full" warning.
It does not mean RWIN is gonna be fully occupied (ZeroWindow condition), but it DOES mean the sender can't send anymore until it gets the next ACK.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
