Ask Your Question

What does a window size scaling factor of -1 mean?

asked 2017-11-24 21:04:52 +0000

dfryers gravatar image

I have a conversation where the calculated window size is either 512 or 509 for most of the communication. The scaling factor is -1 (unknown) throughout the entire conversation even when the calculated window size increases to as high as 6571.

What does a scaling factor of -1 (unknown) mean?

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2017-11-24 21:11:09 +0000

Christian_R gravatar image

updated 2017-11-24 21:13:21 +0000

It means "Unknown". And it is unknown because you haven´t captured the 3WAY Handshake of that session. As the SYN packets are the only packets which can tell you, if Window Scaling is used and what value is used. Otherwise it is next to impossible to determine the correct window size, nowadays.

So a value of 512 or 509 tells you nothing without knowing the scaling factor. Because you need to know with which value you have to multiplicate 509 or 512. But I would assume, that you are far away from a ZERO window.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2017-11-24 21:04:52 +0000

Seen: 4,379 times

Last updated: Nov 24 '17