Ethereal-users: Re: [Ethereal-users] Question about "Window size" field

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 29 Oct 2003 13:39:34 -0800

On Oct 29, 2003, at 1:30 PM, Yingchao Liu wrote:


I'm trying to use ethereal to reconstruct a tcp communication.
What I'm retrieving is the traffic of a simple web session
initiated from mozilla in Linux to a website. I'm especially
interested in the send window size and the receive window size
at that certain time point for each packet.
The segment of output is as follows. I have no clue about
what "window size" means in the output.
It means the window size in the TCP header (what RFC 793 calls "Window"), scaled by the window scaling option if you have relative sequence numbers enabled (which you don't appear to) and if your capture includes a packet where window scaling is negotiated.
I.e., it's the receive window offered by the machine sending the TCP segment, although if window size scaling is in effect, it might not be the window size in bytes. 


 The "next sequence number" also seems bizarre to me.
It's the sequence number with which the next segment would start (i.e., current sequence number plus number of payload bytes; 3799174939 + 513 = 3799175452).