 | 1 | initial version |
Check the Display Filter Reference for TCP fields.
tcp.options.wscale.shift is the option value in the packet.
tcp.options.wscale.multiplier is the Wirehark generated value for the multiplier.
Do you want to know if the options exists:
tcp.options.wscale.shift && tcp.flags.syn==1 && tcp.flags.ack==1
Or that it affects the window size:
(tcp.options.wscale.shift > 0) && tcp.flags.syn==1 && tcp.flags.ack==1
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
