Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

TCP traffic SYN/ACK packets that contain window scaling options

Hello, in your opinion how can I filter TCP traffic SYN/ACK packets that does contain window scaling options?

Can I use !(window_size_scalefactor == -2)?

(tcp.flags.syn==1 && tcp.flags.ack==1) && !(tcp.window_size_scalefactor == -2)

Window size scaling factor: -1 (unknown, start of session not captured) Window size scaling factor: -2 (no window scaling used)