Calculated window size

[pslavkovsky]

Hi

I captured some TCP comunication because there is a issue with long respons of some application.

I see in some TCP packets using Wireshark:

window size value:593

{Calculated window size: 151808}

{Window size scaling factor: 256}

Can this values indicate some issue?

Or is it correct?

I have other capture when respons of application is OK and there is still the same value "window size value" and "Calculated window size"

Thanks

Peter

[Joseph W. Doherty]

Disclaimer

The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.

Liability Disclaimer

In  no event shall Author be liable for any damages whatsoever (including,  without limitation, damages for loss of use, data or profit) arising out  of the use or inability to use the posting's information even if Author  has been advised of the possibility of such damage.

Posting

It's correct.

Window size is only two bytes, so it cannot be larger than 64KB.  To allow larger receive windows, another byte (I think actually 7 bits) were made an option to "scale" window size by some power of two.  So if scale "says" multiply 64KB by 4, actual window size is 256KB.

Windows scaling is an option of later TCP.  Older TCP stacks don't support it, and if they don't, they revert to using window size as is.

[Jean-Claude Lefebvre Jr]

Thank you, I was looking for the same answer, RFC 1323 has more details.