Wireshark · Wireshark-dev: Re: [Wireshark-dev] Question about tcp window scaling value

["Douglas Wood" <doug.wood@xxxxxxxx>]

It's working in 1.5.0-SVN-35425.  I found out that there have been problems
with tshark versus Wireshark output vice what the GUI reports even back to
version 1.2.9.  I had been using tshark for output and looking at the GUI
with Wireshark and that was consistent in 1.2.9.  Consistency was broken
between the GUI and tshark in 1.4.2.

Are the values tcp.window_size, tcp.window_size_value and
tcp.window_size_scalefactor going to be stable going forward?  I like having
all those when there is a scale factor in use.

Doug

-----Original Message-----
From: Sake Blok [mailto:sake@xxxxxxxxxx] 
Sent: Saturday, January 08, 2011 10:58 AM
To: doug.wood@xxxxxxxx; Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Question about tcp window scaling value

On 8 jan 2011, at 15:12, Douglas Wood wrote:

> I have tried the options that you have stated.  It doesn't appear to make
> any difference.  For what it's worth, tshark seems to generate the correct
> values for TCP Window Size.  PDML output is different for tshark than
> Wireshark.

I just updated the code for TCP window scaling (as per bug 5541), could you
try an automated build from http://www.wireshark.org/download/automated/
(use an installer number that is 35425 or higher, available in a couple of
hours) to see whether this also fixed your output issues?

If it didn't, could you please file a bug report at
https://bugzilla.wireshark.org. Please provide the capture file, tshark pdml
output and wireshark pdml output so we can find out why you see a
difference.

Cheers,


Sake