Wireshark-users: Re: [Wireshark-users] Window scaling
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Robert Dahlem <Robert.Dahlem@xxxxxxx>
Date: Mon, 6 Jun 2016 17:31:09 +0200
On 01.06.2016 21:01, Jim Aragon wrote:

> As Chris pointed out, packets with the SYN bit set are never scaled, so
> the window size value and the calculated window size are the same, but f
> you look farther down in the captured packets, past the SYN and SYN/ACK,
> you will see that the calculated window size is the number in the window
> size value field multiplied by the scale factor.


I do not agree with the statement that packets with the SYN bit set are
never scaled. In this particular case the SYN/ACK packet is the only one
the client ever sees from the server until the problem shows up. So
sure, the window that the server opens to the client is scaled at this
moment.

Anyway, I finally came down to the bottom of this: my system is a SLES
11 SP4 with a Linux kernel 3.0.101, a pretty old one. From what I read
there might be a problem with the kernels view on window scaling. But
one can tell the kernel to ignore out-of-window packets with

	sysctl -w net.netfilter.nf_conntrack_tcp_be_liberal = 1

Kind regards,
Robert