 | 1 | initial version |
It means "Unknown". And it is unknown because you haven´t captured the 3WAY Handshake of that session. As the SYN packets are the only packets which can tell you, if Window Scaling is used and what value is used. Otherwise it is next to impossible to determine the correct window size, nowadays.
| | 2 | No.2 Revision |
It means "Unknown". And it is unknown because you haven´t captured the 3WAY Handshake of that session. As the SYN packets are the only packets which can tell you, if Window Scaling is used and what value is used. Otherwise it is next to impossible to determine the correct window size, nowadays.
So a value of 512 or 509 tells you nothing without knowing the scaling factor. Because you need to know with which value you have to multiplicate 509 or 512. But I would assume, taht you are far away from a ZERO window.
| | 3 | No.3 Revision |
It means "Unknown". And it is unknown because you haven´t captured the 3WAY Handshake of that session. As the SYN packets are the only packets which can tell you, if Window Scaling is used and what value is used. Otherwise it is next to impossible to determine the correct window size, nowadays.
So a value of 512 or 509 tells you nothing without knowing the scaling factor. Because you need to know with which value you have to multiplicate 509 or 512. But I would assume, taht that you are far away from a ZERO window.
