Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Check the Display Filter Reference for TCP fields.

tcp.options.wscale.shift is the option value in the packet.
tcp.options.wscale.multiplier is the Wirehark generated value for the multiplier.

Do you want to know if the options exists:

tcp.options.wscale.shift && tcp.flags.syn==1 && tcp.flags.ack==1

Or that it affects the window size:

(tcp.options.wscale.shift > 0) && tcp.flags.syn==1 && tcp.flags.ack==1