This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark filter for window size

0

Hi. Is there a way to graph packets' window size. What I want to do is to see how TCP stream's receive window size changes in the I/O graph. I'm aware of the tcp.window_size and tcp.window_size_value filters but those just graph every packet that has any window size in the first place. Thanks.

-Rakki

asked 14 Nov '12, 00:55

rakki's gravatar image

rakki
0558
accept rate: 0%

If you want to plot the value of a field, you can do this with the advanced plot features in the I/O Graph dialog.

(26 Apr '15, 02:38) Christian_R

2 Answers:

2

did you try this?

Statistics -> TCP Stream Graph -> Window Scaling Graph

Regards
Kurt

answered 14 Nov '12, 01:23

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Exactly what I was looking for. Thanks, Kurt.

(14 Nov '12, 01:43) rakki

If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(14 Nov '12, 07:45) Kurt Knochner ♦

2

Besides the answer of @Kurt: you can see also the Window size in the TCP Time-Sequence Graph when choosing the tcptrace style. The window size is the line above the actual sequence number line, and in that graph it is very nice to see how the sequence numbers relate to the remaining window size. The same graph also shows a third line (below the sequence line) that will tell you what has been ACKed.

Also, you could add a column to your Wireshark setup containing the window size and export the packet list as CSV. That way you can graph whatever you like in programs like Excel or similar tools.

answered 14 Nov '12, 01:40

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%