Ask Your Question
0

Not understanding "Window scaling" graph

asked 2018-02-01 06:21:14 +0000

Vindra gravatar image

updated 2018-02-01 07:25:38 +0000

Jaap gravatar image

Please refer to the attached pcap file.

The window scaling from 205.234.218.129:80 -> 172.16.0.122:41834 shows that most of the time the recv window size is 60K. But the pack info tell different fact. For example refer to packet#99. The "Packet info" shows the window size is 14306. But the green line depicting Recv Win stays above 50000 (Byte). Why so?

THANKS

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-02-01 11:22:46 +0000

updated 2018-02-02 22:55:43 +0000

Seems that you have mixed up something:

The RecvWindow shows you the amount of RecvBuffer on the host who sends it.

I will try to explain.

The client (172.16.0.122) advertises a scalefactor of 64.

The server (205.234.218.129) advertises a scalefactor of 2.

So Packet #99 comes from the server and he advertises the client, that he is able to receive 14306 Bytes now. But what is important to the server and what you see in the graph, is the amount of bytes which the client is able to receive at the moment of packet #99. Therefore you have to look at the packet #98 where the client advertises the actual receive window size of 64128 Bytes. Hint try the button Switch direction in the StreamGraph window.

Maybe this link helps you to understand the different kind of buffer sizes. https://sharkfesteurope.wireshark.org...

edit flag offensive delete link more

Comments

Hi Christian, Thanks for the elaborate answer. I have two follow-up comments/questions: 1) When you say, "..client, that he has is to receive 14306 Bytes now." , do you mean the server is able to receive maximum of 14306 Bytes?

2) Would it be better to rename "Recv Win" as "Recv Win of the other end" in the "Window Scaling" graph?

Thanks for the link to your Sharkfest presentation. But it is way beyond my ability to understand those now. Regards

Vindra gravatar imageVindra ( 2018-02-02 10:45:05 +0000 )edit

At 1) Yes the server is able to receive 14306 Bytes or in other Words: His Receive Window is 14306 Bytes large.

To Point 2) Maybe it could be better, but I think they are fine.

Christian_R gravatar imageChristian_R ( 2018-02-02 23:00:11 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-02-01 06:21:14 +0000

Seen: 201 times

Last updated: Feb 02