3-way handshake and TCP buffer size.
hello all,
i analyzed the 3-way handshake packets there i noticed that the other server side has no TCP option for window scaling... could it be the reason that the other server has got very small TCP buffer size ??
Internet Protocol Version 4, Src: 182.93.86.4, Dst: 10.0.54.1 Transmission Control Protocol, Src Port: 62718, Dst Port: 7002, Seq: 0, Len: 0 Source Port: 62718 Destination Port: 7002 [Stream index: 0] [TCP Segment Len: 0] Sequence Number: 0 (relative sequence number) Sequence Number (raw): 830838424 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 0 Acknowledgment number (raw): 0 1000 .... = Header Length: 32 bytes (8) Flags: 0x0c2 (SYN, ECN, CWR) Window: 8192 [Calculated window size: 8192] Checksum: 0x2977 [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted TCP Option - Maximum segment size: 1460 bytes TCP Option - No-Operation (NOP) TCP Option - Window scale: 8 (multiply by 256) Kind: Window Scale (3) Length: 3 Shift count: 8 [Multiplier: 256] TCP Option - No-Operation (NOP) TCP Option - No-Operation (NOP) TCP Option - SACK permitted [Timestamps]
....From the other server....
Internet Protocol Version 4, Src: 10.0.54.1, Dst: 182.93.86.4 Transmission Control Protocol, Src Port: 7002, Dst Port: 62718, Seq: 0, Ack: 1, Len: 0 Source Port: 7002 Destination Port: 62718 [Stream index: 0] [TCP Segment Len: 0] Sequence Number: 0 (relative sequence number) Sequence Number (raw): 2764694225 [Next Sequence Number: 1 (relative sequence number)] Acknowledgment Number: 1 (relative ack number) Acknowledgment number (raw): 830838425 0110 .... = Header Length: 24 bytes (6) Flags: 0x012 (SYN, ACK) Window: 65535 [Calculated window size: 65535] Checksum: 0xec04 [unverified] [Checksum Status: Unverified] Urgent Pointer: 0 Options: (4 bytes), Maximum segment size TCP Option - Maximum segment size: 1360 bytes [SEQ/ACK analysis] [Timestamps]
is this normal ?? or it might cause bandwidth congestion ?
Regards, Rajesh shrestha
