Wireshark-dev: Re: [Wireshark-dev] Question about tcp window scaling value
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Ed Beroset <beroset@xxxxxxxxxxxxxx>
Date: Sun, 02 Jan 2011 11:07:47 -0500
Douglas Wood wrote:

In Wireshark 1.4.2, export to PDML from tshark sometimes results in a different value for tcp window size compared to doing the same export from the Wireshark GUI.  The different value reflects multiplying the tcp window value with the current window scaling size for tshark and not taking window scaling into account for Wireshark.
Is this a bug? 

No, it's a feature.  :)
If not, how can I tell the difference between the two outputs? I'd rather not write code that cares if tshark generated the output or Wireshark.
There is a TCP preference "Window scaling" that controls this. Note that you must also have the "Analyze TCP sequence numbers" enabled for this to take effect.
As always, you can also specify an option override on the command line as -o tcp.window.scaling:TRUE 

Ed