Ask Your Question
0

Negative Window scaling factor

asked 2019-10-19 15:42:14 +0000

Harneet Singh gravatar image

My Question is related to the post below:-

https://osqa-ask.wireshark.org/questi...

You may use below filter to see the details:-

(ip.addr eq 192.168.0.105 and ip.addr eq 103.243.221.51) and (tcp.port eq 56382 and tcp.port eq 443)

Please help me understand that in 58 segment, why TCP shows -2 window scaling factor while server did not specify it in the handshake.

For some reason I am not able to upload the PCAP file. Is there any place I could upload it as I get the error that I need to have > 60 points to upload a file.

edit retag flag offensive close merge delete

Comments

You can upload to anywhere else and post a publicly accessible link here.

Jaap gravatar imageJaap ( 2019-10-19 18:44:47 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-10-19 22:41:42 +0000

SYN-bit gravatar image

updated 2019-10-22 22:58:52 +0000

The field tcp.window_size_scalefactor can have the following values:

  • -2: The 3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used
  • -1: Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used
  • 0: The host supports window-scaling, but will not use window-scaling itself (multiply by 2^0=1)
  • n (n>0): The host supports window-scaling, it will use window-scaling (multiply by 2^n)
edit flag offensive delete link more

Comments

This begs the question if this composite field should be split into a field with the actual scaling factor (the tcp.window_size_scalefactor) and fields or expert items with the other information, regarding "3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used" and "Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used".

Jaap gravatar imageJaap ( 2019-10-20 07:21:57 +0000 )edit

It also needs to be clear (if it isn't already) if the scaling factor was forced by the preference setting 'Scaling factor to use when not available from capture'.

MartinM gravatar imageMartinM ( 2019-10-20 09:04:39 +0000 )edit

@MartinM Good point.

Jaap gravatar imageJaap ( 2019-10-20 10:34:16 +0000 )edit

Thanks everyone. It clears my doubts :).

Harneet Singh gravatar imageHarneet Singh ( 2019-10-20 10:44:11 +0000 )edit

It also needs to be clear (if it isn't already) if the scaling factor was forced by the preference setting 'Scaling factor to use when not available from capture'.

It is: Window size scaling factor: 4 (missing - taken from preference)

SYN-bit gravatar imageSYN-bit ( 2019-10-20 19:14:42 +0000 )edit
see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2019-10-19 15:42:14 +0000

Seen: 2,128 times

Last updated: Oct 22 '19