Wireshark · Wireshark-users: Re: [Wireshark-users] TCP connection window size change question

[Andrew Hood <ajhood@xxxxxxxxx>]

George Vandelet wrote:
> Wireshark superusers,
> 
> I have been looking at captures and many times I see at the end of an TCP HTTP 
> session a TCP packet (or series of TCP packets) that looks to (in wireshark) 
> change the window size.  Why does wireshark show that the window size changes 
> right before the TCP session is closed?  It does not make sense to change the 
> window size after the first FIN,ACK ->ACK exchange has been done as there is 
> nothing to do after that except for close the connection with the following 
> FIN,ACK ->ACK! 

Just because one end has sent a FIN it does not mean the other end has
finished sending. A half-close causes a FIN, but does not stop the
program from reading data coming back.

Hence reporting window size changes is still appropriate.

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who