Wireshark · Wireshark-dev: Re: [Wireshark-dev] Question about tcp window scaling value

["Douglas Wood" <doug.wood@xxxxxxxx>]

I have tried the options that you have stated.  It doesn't appear to make
any difference.  For what it's worth, tshark seems to generate the correct
values for TCP Window Size.  PDML output is different for tshark than
Wireshark.

Doug


-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx
[mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Ed Beroset
Sent: Sunday, January 02, 2011 11:08 AM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Question about tcp window scaling value

Douglas Wood wrote:
> In Wireshark 1.4.2, export to PDML from tshark sometimes results in a
different value for tcp window size compared to doing the same export from
the Wireshark GUI.  The different value reflects multiplying the tcp window
value with the current window scaling size for tshark and not taking window
scaling into account for Wireshark.
> 
> Is this a bug?  

No, it's a feature.  :)

>If not, how can I tell the difference between the two outputs?  I'd 
rather not write code that cares if tshark generated the output or 
Wireshark.

There is a TCP preference "Window scaling" that controls this.  Note 
that you must also have the "Analyze TCP sequence numbers" enabled for 
this to take effect.

As always, you can also specify an option override on the command line 
as -o tcp.window.scaling:TRUE

Ed
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe