 | 1 | initial version |
Usually a window size of 254 is an indication that the three-way-handshake was not captured and thus the window scaling factors are unknown. This means Wireshark can only show the value of the window size field value, instead of the really used size of the window. Sometimes the traffic pattern can give an idea on what the scale factor must have been and then you can set that in the TCP protocol preferences.
It is better though to make sure the 3-way-handshake is also captured, makes life a lot easier :-)
