 | 1 | initial version |
Hi,
The first thing to say is that the Windows Scaling Factor is only set by Option values in the SYN and SYN/ACK. You will see this in the TCP header of every packet simply because Wireshark is remembering the value for you and presenting it. You can tell that the value in the header is generated by Wireshark because it is enclosed in square brackets. All values in square brackets are generated fields rather than fields in the protocol.
Scaling factor shows the number of leftward bit shifts that should be used for an advertised window size. The affect is multiplication; an 8 bit shift being equivalent to a multiplication factor of 256. Therefore, for the server to determine the size of the client-side receive window, it should multiply the advertised size by 256.
Your trace shows that for data flowing from the server to the client, a scaling factor of 8 is applied to windows advertised by the client, and a scaling factor of 14 is applied to windows advertised by the server.
For part 2 of your question, I think you are muddling scaling factor with advertised window size. Scaling factor just tells the sender how to calculate the effective window size. The actual size can be any value from 0 up to 64k x the scaling factor.
What are the operating systems of the client and server?
Best regards...Paul
PS: Sorry for the length of this response. If I had more time I'd have made it shorter.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
