Ask Your Question
0

Small packet length and Window size

asked 2022-08-12 09:50:07 +0000

johnshark gravatar image

updated 2022-08-12 10:04:14 +0000

grahamb gravatar image

I started learning Wireshark a few days ago, still new to it, so please bear with me.

I tried a couple of packet captures on my network while browsing a bit over the internet - as suggested and by teachers online in order to get used to its outputs.

I noticed that the packet length and the Window size are quite small.

Here is a screenshot:

I was wondering if there can be a problem with my network which is worth investigating on.

Your thoughts about it please.

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted
0

answered 2022-08-12 16:50:14 +0000

André gravatar image

Regarding the packet length:
In the posted image frame number 67 (SYN/ACK) shows a Maximum Segment Size (MSS) of 1430 bytes. So the maximum size used is: 1430 (data) + 20 (TCP) + 20 (IP) + 14 (Eth) = 1484 bytes.

Regarding the window size:
The same frame also shows a Window Scale (WS) of 256 or 'shift by 8'. So actually the maximum window size is not small (16 MB). The picture shows that it starts small and increases during the TLS handshake. Just look up "TCP slow start".

The size of packets with encrypted "Application Data" is mainly determined by the application that runs on top of TCP/TLS. Maybe just small web-requests over https?

edit flag offensive delete link more
0

answered 2022-08-12 12:58:19 +0000

ajaznawaz gravatar image

Some protocols such as SMB are notorious for sending small packets across to the destination. Is the capture taken while performing file transfer of some sort ..?

edit flag offensive delete link more

Comments

No, but I ran another packet capture while performing file transfer from my pc to my server (an old one), just a couple of files, and got this:

link text

a few black lines in a row, and there are others like these down in the capture.

There must be something wrong in my network somewhere.

Thanks

johnshark gravatar imagejohnshark ( 2022-08-12 15:18:58 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

2 followers

Stats

Asked: 2022-08-12 09:49:26 +0000

Seen: 71 times

Last updated: Aug 12