1

I see that the calculated window size is set to 5888 with the three handshake, however it jumps to 7808 with the first ACK. Can someone explain me why and what algorithm Linux (Linux OS and Wireshark) used to calculate this window?

I understand window scaling concept and I don't have any congestion or slow start at this point of time. 5888 was SYN. 2000 in flight after two seg push. So you have 3888 available now. At this point you send ACK 1001, so the receiver shoots out ACK with updated window size (3888+1000=4888). But I see 7808! How? I observe such increase for every ack, unable to quantitatively reason this out.

2
  • I understand window scaling concept and i don't have any congestion or slow start at this point of time. 5888 was syn. 2000 in flight after two seg push. So you have 3888 available now. At this point you send ack 1001 , so the receiver shoots out ack with updated window size ( 3888+1000) =4888. But i see 7808! How? I observe such increase for every ack, unable to quantitatively reason this out. – Joanna Dec 9 '15 at 6:51
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 20:38
3

This post has a good explanation for what you're seeing.

What you see is normal behavior. Both sides send a small window size and neither announce that they are able to use window scaling. So in the next step they both pull up their TCP window to 64k to allow the other node to send more than just a few packets in case that there is a lot of data to be transferred.

It's quite normal to see that kind of session behavior - as soon as both know that the connection is established and what the parameters are they simply adjust their window.

And,

It is to conserve memory for connection that are not guaranteed to be established yet. The OS/TCP stack needs to reserve as much memory for incoming bytes as promised in the window size (which is essentially just a buffer), so if you waste too much memory on connections from the start you might run out of memory.

3
  • My question is how to quantify the increase? By what factor or parameter does this increase and can we find this out through the capture data available because i do not know which OS was used while capturing this data. – Joanna Dec 10 '15 at 15:45
  • I don't believe there is any standard, the application will simply increase it to a figure which it has been coded to so long as the system has the resources available. In regards to finding out which OS was used, perhaps you find out by analysing the traffic types the host used? Is there a reason why you need to know which OS was used anyway? – OzNetNerd Dec 10 '15 at 17:08
  • I have found that Linux was used. Is there a way to find what auto tuning algorthm has been applied from the wireshark capture file? – Joanna Dec 13 '15 at 2:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.