Wireshark · Wireshark-users: [Wireshark-users] [TCP Window Update] & bytes_in_flight

[Martin Andersson <hello.martin@xxxxxxxx>]

Hello

I have two questions.

1.
What defies an [TCP Window Update]
By looking at a trace, do I understand this correctly that wireshark mark a 
packet as Window Update when it receives a "duplicated ACK" when the window 
size has changed as well.

2.
What does "Number of bytes in flight" means. By the wording I get the 
impression it should represent number of bytes "sent" which has not been 
acknowledged yet. If so will the tcpgraph then be close to the windowsize (i.e 
the upper gray line) if bytes_in_flight is close to advertised window size.
Also can bytes_in_flight > Window size (at least it seems so in my trace).

brg/Martin