Wireshark · Wireshark-users: Re: [Wireshark-users] Window scaling

[Lee <ler762@xxxxxxxxx>]

On 6/6/16, Robert Dahlem <Robert.Dahlem@xxxxxxx> wrote:
>
>
> On 06.06.2016 17:37, ronnie sahlberg wrote:
>
>>> I do not agree with the statement that packets with the SYN bit set are
>>> never scaled.
>>
>> The standard is pretty clear for this case.
>
>> The Window field in a SYN (i.e., a <SYN> or <SYN,ACK>) segment
>> itself is never scaled.
>
> Maybe my English is not good enough for the proper definition of
> "scaled". To clarify this for me: I have a SYN/ACK packet with Window
> size 8192 and Window scale 8 (multiply by 256): is the client allowed to
> send 8192 or 2G bytes without seeing the first ACK without SYN from the
> server?

You're supposed to start out in 'slow start', so unless the MTU is
>4KB it's probably allowed to send two packets.  See
https://tools.ietf.org/html/rfc5681
  3.1.  Slow Start and Congestion Avoidance

Regards,
Lee