Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2019-10-19 22:41:42 +0000

SYN-bit gravatar image

The field tcp.window_size_scalefactor can have the following values:

  • -2: The 3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used
  • -1: Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used
  • 0: The host supports window-scaling, but will not use window-scaling itself (multiply by 2^0=1)
  • n (n>0): The host supports window-scaling, but will not use window-scaling itself (multiply by 2^n)

The field tcp.window_size_scalefactor can have the following values:

  • -2: The 3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used
  • -1: Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used
  • 0: The host supports window-scaling, but will not use window-scaling itself (multiply by 2^0=1)
  • n (n>0): The host supports window-scaling, but it will not use window-scaling itself (multiply by 2^n)