Revision history [back]

Revision 1

answered 2022-03-19 00:50:18 +0000

Check the Display Filter Reference for TCP fields.

tcp.options.wscale.shift is the option value in the packet.
tcp.options.wscale.multiplier is the Wirehark generated value for the multiplier.

Do you want to know if the options exists:

tcp.options.wscale.shift && tcp.flags.syn==1 && tcp.flags.ack==1

Or that it affects the window size:

(tcp.options.wscale.shift > 0) && tcp.flags.syn==1 && tcp.flags.ack==1