Hi, I'm new in here and would like to ask a question. I'm currently working on my Bachelor thesis. I need to change receiver buffer (advertised window). and, except for Wireshark I need to use another application - FlowGrind (to get Congestion window, as that is not present in packet and can`t be seen in Wireshark). The thing is: When I set "receiver buffer size (advertised window) in FlowGrind and then run it, I see different Windows size in Wireshark. For example: FlowGrind - Wireshark 400 - 1200, 2000 - 1460, 4000 - 2896, 6000 - 4392. After simple calculation, I found out that the Wireshark value is always about 70% of value set in FlowGrind. IS ANYBODY ABLE TO EXPLAIN THAT, PLEASE? Thank you in advance Radim asked 22 Mar '13, 13:35  radim0574 edited 22 Mar '13, 14:22  Jim Aragon |
One Answer:
The Flowgrind documentation speaks of the receive buffer size and the advertised window as if they are the same thing. Strictly speaking, they are not. The receive buffer size is the size of the buffer that is allocated in memory to receive incoming TCP data on that connection. Once this buffer is allocated, its size does not generally change. The advertised window is the amount of space available in the receive buffer. While the size of the buffer does not change, the amount of space available in the buffer changes. As incoming data is received and is stored in the buffer, the amount of space available (the advertised window) goes down. Then when the application pulls data out of the receive buffer, the amount of space available goes up. Wireshark shows the actual advertised window, which changes dynamically. answered 25 Mar '13, 12:50 Jim Aragon |
Hi, Thank you for your answer, however, that doesn`t clear this up at all:). My text focuses on two things: 1) Wireshark - Congestion windown (ANY possibility how to find out) 2) FlowGrind & Wireshark "Advertiised window" differences as mentioned above, in my firt text
Regards,
Radim