This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP RWin with window scaling

0

Hey everyone,

just wondered: if i have a TCP packet with SYN flag set, there is a window size set in the RWIN header field (e.g. 0x2000) and there might be a window scale option in the options section (eg 0x030308 --> WinScale, Len 3, shift by 8). From what I understand, RWin should be (0x2000 << 8 = 0x20000 = 2097152 Byte) in this case. However, wireshark displays:

Window Size Value: 8192

[calculated window size: 8192]

Window Scale: 8 (Multiply by 256)

So Im wondering .. is either the value for RWin incorrect or is the RWin calculation incorrect? (or none of both and i just misunderstood something?)

asked 22 Feb '17, 02:05

DemoniacMilk's gravatar image

DemoniacMilk
6113
accept rate: 0%


One Answer:

3

Please have a look here: https://ask.wireshark.org/questions/51352/window-size-value-in-the-ack-packet-of-a-syn-synack-ack-handshake?page=1&focusedAnswerId=51353#51353 Inside the SYN packet the WindowSaling is never used (RFC). So Wireshark is absolutely correct.

answered 22 Feb '17, 02:36

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

Ah thank you! So its more like "hey i would like to use window scaling if you support it" with a backwards-compatible, non-shifted window size in the header.

(22 Feb '17, 06:33) DemoniacMilk

Yes that is true!

(22 Feb '17, 06:53) Christian_R