Small packet length and Window size

WindowSize

asked 2022-08-12 09:50:07 +0000

johnshark
3 ●1 ●2

updated 2022-08-12 10:04:14 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

I started learning Wireshark a few days ago, still new to it, so please bear with me.

I tried a couple of packet captures on my network while browsing a bit over the internet - as suggested and by teachers online in order to get used to its outputs.

I noticed that the packet length and the Window size are quite small.

Here is a screenshot:

I was wondering if there can be a problem with my network which is worth investigating on.

Your thoughts about it please.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2022-08-12 16:50:14 +0000

André

176 ●70 ●3

Regarding the packet length:
In the posted image frame number 67 (SYN/ACK) shows a Maximum Segment Size (MSS) of 1430 bytes. So the maximum size used is: 1430 (data) + 20 (TCP) + 20 (IP) + 14 (Eth) = 1484 bytes.

Regarding the window size:
The same frame also shows a Window Scale (WS) of 256 or 'shift by 8'. So actually the maximum window size is not small (16 MB). The picture shows that it starts small and increases during the TLS handshake. Just look up "TCP slow start".

The size of packets with encrypted "Application Data" is mainly determined by the application that runs on top of TCP/TLS. Maybe just small web-requests over https?

edit flag offensive delete link

add a comment

answered 2022-08-12 12:58:19 +0000

ajaznawaz
1 ●13 ●4

Some protocols such as SMB are notorious for sending small packets across to the destination. Is the capture taken while performing file transfer of some sort ..?

edit flag offensive delete link

Comments

No, but I ran another packet capture while performing file transfer from my pc to my server (an old one), just a couple of files, and got this:

link text

a few black lines in a row, and there are others like these down in the capture.

There must be something wrong in my network somewhere.

Thanks

johnshark ( 2022-08-12 15:18:58 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Small packet length and Window size

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

Small packet length and Window size edit

2 Answers

Comments

Your Answer

Question Tools

Stats

Related questions

Small packet length and Window size