Please refer to the attached pcap file.
The window scaling from 205.234.218.129:80 -> 172.16.0.122:41834 shows that most of the time the recv window size is 60K. But the pack info tell different fact. For example refer to packet#99. The "Packet info" shows the window size is 14306. But the green line depicting Recv Win stays above 50000 (Byte). Why so?
THANKS
Seems that you have mixed up something:
The RecvWindow shows you the amount of RecvBuffer on the host who sends it.
I will try to explain.
The client (172.16.0.122) advertises a scalefactor of 64.
The server (205.234.218.129) advertises a scalefactor of 2.
So Packet #99 comes from the server and he advertises the client, that he is able to receive 14306 Bytes now. But what is important to the server and what you see in the graph, is the amount of bytes which the client is able to receive at the moment of packet #99. Therefore you have to look at the packet #98 where the client advertises the actual receive window size of 64128 Bytes. Hint try the button Switch direction in the StreamGraph window.
Maybe this link helps you to understand the different kind of buffer sizes. https://sharkfesteurope.wireshark.org...
Hi Christian, Thanks for the elaborate answer. I have two follow-up comments/questions: 1) When you say, "..client, that he has is to receive 14306 Bytes now." , do you mean the server is able to receive maximum of 14306 Bytes?
2) Would it be better to rename "Recv Win" as "Recv Win of the other end" in the "Window Scaling" graph?
Thanks for the link to your Sharkfest presentation. But it is way beyond my ability to understand those now. Regards
At 1) Yes the server is able to receive 14306 Bytes or in other Words: His Receive Window is 14306 Bytes large.
To Point 2) Maybe it could be better, but I think they are fine.
Asked: 2018-02-01 06:21:14 +0000
Seen: 2,268 times
Last updated: Feb 02 '18
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
