I have a conversation where the calculated window size is either 512 or 509 for most of the communication. The scaling factor is -1 (unknown) throughout the entire conversation even when the calculated window size increases to as high as 6571.
What does a scaling factor of -1 (unknown) mean?
It means "Unknown". And it is unknown because you haven´t captured the 3WAY Handshake of that session. As the SYN packets are the only packets which can tell you, if Window Scaling is used and what value is used. Otherwise it is next to impossible to determine the correct window size, nowadays.
So a value of 512 or 509 tells you nothing without knowing the scaling factor. Because you need to know with which value you have to multiplicate 509 or 512. But I would assume, that you are far away from a ZERO window.
Asked: Nov 24 '17
Seen: 4,789 times
Last updated: Nov 24 '17
