Wireshark-users: Re: [Wireshark-users] [TCP Window Update] & bytes_in_flight
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Martin Andersson <hello.martin@xxxxxxxx>
Date: Tue, 2 Mar 2010 01:40:15 +0100
On Tuesday 02 March 2010 01:19:42 am ronnie sahlberg wrote:
> On Tue, Mar 2, 2010 at 10:37 AM, Martin Andersson <hello.martin@xxxxxxxx> 
> > Also can bytes_in_flight > Window size (at least it seems so in my
> > trace).
> 
> No, not unless the TCP implementation is broken, or unless there is
> WindowScaling used and you didnt capture the initial SYN pacekts.

Maybe something is strange then (because I have the whole trace, including SYN 
SYN/ACK).
It might be something with the TCP offloading I believe is in effect on the 
machine, since I have this huge ftp packets, which I can only assume will 
occur when tcp offloading is enabled. (ie I see large chunk of ftp-data with 
no  tcp packets in between).