Olivier,
thanks a lot for the tips and explanations. I really appreciate it.
:-) I guess what I meant to say was "now the network guys can once
again correlate their Windows-based traffic sniffer output to my
Ethereal". Bottom line: their program sucks, mine doesn't. :-) Thanks
again.
Arne
On Wed, 2004-03-24 at 14:04, Biot Olivier wrote:
> |-----Original Message-----
> |From: Arne Sagnes
> |
> |Olivier,
> | thanks for the quick response. You seem to have hit the
> |nail right on
> |the head, as turning off the "TCP Window Scaling" option in
> |the Ethereal
> |GUI actually fixed it. Just out of curiosity, can you explain what the
> |nature of this option really is? I can't seem to find any good
> |documentation on the site that describes this one. Anyways, thanks for
> |straightening that out for me. Now Ethereal makes sense again. :)
>
> Ummm... You're turning things up-side down :)
>
> The TCP protocol provides a protocol option known as Window Scaling.
> When
> this option is in effect, a TCP implementation can increase its
> effective
> send/receive window by using a scale factor which is then applied to the
> WIN
> value.
>
> Ethereal is able to compute the *real* window size (which seems to be
> twice
> as large as the value you see in the WIN value). You have now disabled
> this,
> and as a result you now won't get the *correct* window sizes.
>
> The function of the TCP preferences in Ethereal is well explained via
> the
> tooltips. If you hover over a preference, an explanatory text will give
> you
> some more information on how to use them (some preferences rely upon
> other
> preferences in order to work).
>
> Hope this helps!
>
> Regards,
>
> Olivier
--
Arne Sagnes - Email: asagnes@xxxxxxxxxxx
Work: +1 440 949 8225 - Cell: +1 216 577 2319
Be careful of reading health books, you might die of a misprint.
