Negative Window scaling factor

asked 2019-10-19 15:42:14 +0000

Harneet Singh
3 ●1 ●2 ●4

My Question is related to the post below:-

https://osqa-ask.wireshark.org/questi...

You may use below filter to see the details:-

(ip.addr eq 192.168.0.105 and ip.addr eq 103.243.221.51) and (tcp.port eq 56382 and tcp.port eq 443)

Please help me understand that in 58 segment, why TCP shows -2 window scaling factor while server did not specify it in the handshake.

For some reason I am not able to upload the PCAP file. Is there any place I could upload it as I get the error that I need to have > 60 points to upload a file.

edit retag flag offensive close merge delete

Comments

You can upload to anywhere else and post a publicly accessible link here.

Jaap ( 2019-10-19 18:44:47 +0000 )edit

add a comment

answered 2019-10-19 22:41:42 +0000

SYN-bit

18344 ●9 ●301 ●255 https://SYN-b.it

updated 2019-10-22 22:58:52 +0000

The field tcp.window_size_scalefactor can have the following values:

-2: The 3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used
-1: Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used
0: The host supports window-scaling, but will not use window-scaling itself (multiply by 2^0=1)
n (n>0): The host supports window-scaling, it will use window-scaling (multiply by 2^n)

edit flag offensive delete link

Comments

This begs the question if this composite field should be split into a field with the actual scaling factor (the tcp.window_size_scalefactor) and fields or expert items with the other information, regarding "3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used" and "Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used".

Jaap ( 2019-10-20 07:21:57 +0000 )edit

It also needs to be clear (if it isn't already) if the scaling factor was forced by the preference setting 'Scaling factor to use when not available from capture'.

MartinM ( 2019-10-20 09:04:39 +0000 )edit

@MartinM Good point.

Jaap ( 2019-10-20 10:34:16 +0000 )edit

Thanks everyone. It clears my doubts :).

Harneet Singh ( 2019-10-20 10:44:11 +0000 )edit

It also needs to be clear (if it isn't already) if the scaling factor was forced by the preference setting 'Scaling factor to use when not available from capture'.

It is: Window size scaling factor: 4 (missing - taken from preference)

SYN-bit ( 2019-10-20 19:14:42 +0000 )edit

see more comments

Negative Window scaling factor

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Negative Window scaling factor edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Negative Window scaling factor