Wireshark mailing list archives

Question about tcp window scaling value


From: Douglas Wood <doug.wood () ieee org>
Date: Sun, 2 Jan 2011 10:31:58 -0500

In Wireshark 1.4.2, export to PDML from tshark sometimes results in a different value for tcp window size compared to 
doing the same export from the Wireshark GUI.  The different value reflects multiplying the tcp window value with the 
current window scaling size for tshark and not taking window scaling into account for Wireshark.

Is this a bug?  If not, how can I tell the difference between the two outputs?  I'd rather not write code that cares if 
tshark generated the output or Wireshark.

Sent from my iPad
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: