Need help with the Window Scaling Graph

asked 2023-01-30 21:05:10 +0000

zw1806
3 ●1

So I cannot understand the y-axis of the Window Scaling Graph, and this is the trace file I'm look at: https://drive.google.com/file/d/1jDqo...

And this is the Window Scaling Graph: https://drive.google.com/file/d/1IVYB...

Now I'm looking at the traffic from 10.105.115.137 to 3.143.61.245. If I follow the first dot showing up in the graph, I get packet No 193. And according to the Y-axis of the graph, the Window Size of the receiver 3.143.61.245 should be around 4000 Bytes. However, if I go back to the trace and find the latest ACK from the receiver to 10.105.xxx, I dob't think I could relate the 4000~ Bytes with the Window Size displayed in the captured segments.

The latest ACK before packet 193 was sent was packet 192, which has a Window Size of 409 Bytes. So from my understanding, this should be the suggested window size by the receiver? How does the Window Size field relate to that displayed on the Graph?

I might have misunderstanding in concepts, so please leave any inputs!

answered 2023-01-30 21:39:10 +0000

Chuckc
2858 ●5 ●567 ●19

The blue dots are the outstanding (bytes_in_flight). The faint green line down around 400 is the window size.

8.24. TCP Stream Graphs

Window Scaling Window size and outstanding bytes.

Display Filter Reference: Transmission Control Protocol

tcp.analysis.bytes_in_flight    Bytes in flight Unsigned integer (4 bytes)  1.2.0 to 4.0.3

tcp_stream_dialog.cpp:

            // compute bytes_in_flight for cwnd graph

image description

edit flag offensive delete link

Comments

Hi, thanks for the answer! So another question is how can there be so many bytes in flight if the window size is only around 400 Bytes?

zw1806 ( 2023-01-30 23:11:21 +0000 )edit

Chris is a TCP master - Chris Greer

How TCP Works - Window Scaling and Calculated Window Size

For tcp.stream eq 13 in your lab capture, the 3-way handshake was not captured so the conversation is marked as Incomplete and the Window size is unknown if the scaling factor is not captured..

7.5. TCP Analysis

TCP Conversation Completeness

[Conversation completeness: Incomplete (12)]
...
[Window size scaling factor: -1 (unknown)]

Chuckc ( 2023-01-30 23:27:14 +0000 )edit

Thank you so much for your help!

zw1806 ( 2023-01-30 23:41:30 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Need help with the Window Scaling Graph

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Need help with the Window Scaling Graph edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Need help with the Window Scaling Graph