This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Window Size change

0

hi guys,

i captured a trace while accessing a web page and there's one thing that i don't understand.

in the first SYN sent from my station to the web server i see a 8192 bytes Window Size and 140 MSS. in the SYN,ACK from the web server WS=65535 and MSS=1452.

The ACK from my station advertises it's WS now to = 4356 and right after the ACK i receive an TCP Window Update from the web server with a WS of 2064 ????

why such a big decrease if no actual data has been transferred yet?

asked 12 Mar '15, 15:37

adasko's gravatar image

adasko
86343842
accept rate: 0%


One Answer:

0

Lower window sizes conserve memory, so an operating systems may decide to use small sizes. And as long as it doesn't prevent the sender from continuing to send more data, it's not a problem.

answered 12 Mar '15, 20:57

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%