First time here? Check out the FAQ!

Ask Your Question
0

a Window Scale value on a client of "-1"
 
  
 
 
     
 
 
 
 
 
 
 
    
        
        asked Mar 28 '4  
 
 kmnruser gravatar image  
 
 
 
 
 
I have captured data from an end user as he connects to his server.
The connection will drop a few times a day.
 
As i am gathering data and analyzing it in Wireshark, i see something that may be an anomoly.
 
I see the field for Window Scale sizing factor on the client, and it is set to -1.  I am not sure and have yet to find anything on it by searching.
 
Has anyone else ever seen a Windows scale size set this way?  
 
Thanks in advance,
KMNRuser 
 
Preview: (hide)
 
 
 
 
          
 
add a comment
 
 
 
 
 
 1 Answer
    
 
 
                    Sort by »
                     oldest newest most voted 
 
 
 
 
 
  
 
 
 
 
0
 
 
  
 
 
 
 
 
 
 
 
    
        
        answered Mar 28 '4  
 
 Jim Aragon gravatar image  
 
 
 
 
 
-1 means "Unknown." The SYN and SYN/ACK packets are not in the capture file, so Wireshark does not know if window scaling is in use, and if it is, what the scale factors are.
 
Preview: (hide)
 
 
 
 
         
        link
        
 
Comments
On top of that, a scaling factor of -2 means the SYN and SYN/ACK were indeed seen, but no WS option was seen in the SYN or the SYN/ACK, so -2 means: "No Window Scaling used"
SYN-bit gravatar imageSYN-bit (
    
        Mar 28 '4
    )
On the wiki: TCP Relative Sequence Numbers & TCP Window Scaling
Chuckc gravatar imageChuckc (
    
        Mar 28 '4
    )
add a comment
 
 
 
 
  
 
 
 
 

    
        Your Answer
    

 
 Please start posting anonymously - your entry will be published after you log in or create a new account.

    

 
 
Add Answer
 
 
 
 
 
 
 
 
   
  
 
   
 
 
 
 
 
 
 
 
Question Tools
  
 

        
        
            1 follower
        
    
 
 
 subscribe to rss feed 
 
 
 
 
 
 
Stats
 

        Asked:  Mar 28 '4  
 
 
        Seen: 72 times 
 

        Last updated: Mar 28 '24