Ask Your Question
0

Need help with the Window Scaling Graph

asked 2023-01-30 21:05:10 +0000

zw1806 gravatar image

So I cannot understand the y-axis of the Window Scaling Graph, and this is the trace file I'm look at: https://drive.google.com/file/d/1jDqo...

And this is the Window Scaling Graph: https://drive.google.com/file/d/1IVYB...

Now I'm looking at the traffic from 10.105.115.137 to 3.143.61.245. If I follow the first dot showing up in the graph, I get packet No 193. And according to the Y-axis of the graph, the Window Size of the receiver 3.143.61.245 should be around 4000 Bytes. However, if I go back to the trace and find the latest ACK from the receiver to 10.105.xxx, I dob't think I could relate the 4000~ Bytes with the Window Size displayed in the captured segments.

The latest ACK before packet 193 was sent was packet 192, which has a Window Size of 409 Bytes. So from my understanding, this should be the suggested window size by the receiver? How does the Window Size field relate to that displayed on the Graph?

I might have misunderstanding in concepts, so please leave any inputs!

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2023-01-30 21:39:10 +0000

Chuckc gravatar image

The blue dots are the outstanding (bytes_in_flight). The faint green line down around 400 is the window size.

8.24. TCP Stream Graphs

Window Scaling Window size and outstanding bytes.


Display Filter Reference: Transmission Control Protocol

tcp.analysis.bytes_in_flight    Bytes in flight Unsigned integer (4 bytes)  1.2.0 to 4.0.3

tcp_stream_dialog.cpp:

            // compute bytes_in_flight for cwnd graph

image description

edit flag offensive delete link more

Comments

Hi, thanks for the answer! So another question is how can there be so many bytes in flight if the window size is only around 400 Bytes?

zw1806 gravatar imagezw1806 ( 2023-01-30 23:11:21 +0000 )edit

Chris is a TCP master - Chris Greer

How TCP Works - Window Scaling and Calculated Window Size

For tcp.stream eq 13 in your lab capture, the 3-way handshake was not captured so the conversation is marked as Incomplete and the Window size is unknown if the scaling factor is not captured..

7.5. TCP Analysis

TCP Conversation Completeness

[Conversation completeness: Incomplete (12)]
...
[Window size scaling factor: -1 (unknown)]
Chuckc gravatar imageChuckc ( 2023-01-30 23:27:14 +0000 )edit

Thank you so much for your help!

zw1806 gravatar imagezw1806 ( 2023-01-30 23:41:30 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2023-01-30 21:05:10 +0000

Seen: 624 times

Last updated: Jan 30 '23