Negative Window scaling factor

retag add tags

My Question is related to the post below:-

https://osqa-ask.wireshark.org/questi...

You may use below filter to see the details:-

(ip.addr eq 192.168.0.105 and ip.addr eq 103.243.221.51) and (tcp.port eq 56382 and tcp.port eq 443)

Please help me understand that in 58 segment, why TCP shows -2 window scaling factor while server did not specify it in the handshake.

For some reason I am not able to upload the PCAP file. Is there any place I could upload it as I get the error that I need to have > 60 points to upload a file.

Comments

You can upload to anywhere else and post a publicly accessible link here.

Jaap (2019-10-19 18:44:47 +0000) edit

add a comment see more comments

The field tcp.window_size_scalefactor can have the following values:

-2: The 3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used
-1: Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used
0: The host supports window-scaling, but will not use window-scaling itself (multiply by 2^0=1)
n (n>0): The host supports window-scaling, it will use window-scaling (multiply by 2^n)

18.5k

SYN-bit

answered 2019-10-19 22:41:42 +0000, updated 2019-10-22 22:58:52 +0000

edit flag offensive 0 remove flag delete link

Comments

This begs the question if this composite field should be split into a field with the actual scaling factor (the tcp.window_size_scalefactor) and fields or expert items with the other information, regarding "3-way-handshake was seen, but the client and/or the server did not support window scaling, so it is not used" and "Part of the 3-way handshake was not seen and it could not be determined if window-scaling is used".

Jaap (2019-10-20 07:21:57 +0000) edit

It also needs to be clear (if it isn't already) if the scaling factor was forced by the preference setting 'Scaling factor to use when not available from capture'.

MartinM (2019-10-20 09:04:39 +0000) edit

@MartinM Good point.

Jaap (2019-10-20 10:34:16 +0000) edit

Thanks everyone. It clears my doubts :).

Harneet Singh (2019-10-20 10:44:11 +0000) edit

It also needs to be clear (if it isn't already) if the scaling factor was forced by the preference setting 'Scaling factor to use when not available from capture'.

It is: Window size scaling factor: 4 (missing - taken from preference)

SYN-bit (2019-10-20 19:14:42 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Negative Window scaling factor edit

Comments

1 Answer

Comments