Re: TCP connection window size change question

[Andrew Hood <ajhood () fl net au>]

George Vandelet wrote:
> Wireshark superusers,
>
> I have been looking at captures and many times I see at the end of an TCP HTTP 
> session a TCP packet (or series of TCP packets) that looks to (in wireshark) 
> change the window size.  Why does wireshark show that the window size changes 
> right before the TCP session is closed?  It does not make sense to change the 
> window size after the first FIN,ACK ->ACK exchange has been done as there is 
> nothing to do after that except for close the connection with the following 
> FIN,ACK ->ACK! 

Just because one end has sent a FIN it does not mean the other end has
finished sending. A half-close causes a FIN, but does not stop the
program from reading data coming back.

Hence reporting window size changes is still appropriate.

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe