i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken.
I have a dump file of some 110mb that i use for my graphs. This is the traffic between the system used for packet analysis and an FTP server where the initial system asked for a big file.
I have to show the graph for Window Scaling for the received windows that only came from FTP server and make some assumptions of their size.
My actions for Wireshark were to:
- load the dump file
- find the TCP 3-ack packets
- select the first tcp packet after this
- Go Statistics -> TCP Stream Graphs -> Window Scaling
- I get a blank window scaling window, the following:
- I then click 2 times the Stream, increasing from 0 to 2 and i get the following window scaling window:
The 22.214.171.124 is the FTP server and 126.96.36.199 is the initial system.
My questions are:
How to restrict the received windows only to those coming from FTP server? Should i only leave the Rcv Win checkbox below checked?
How to find out when / where in the graph that the received window size is more than 200 KB by just looking at those green dots in the top of graph?
Why is the received window this size and not the default (i think) 65 KB ? It seems the majority is more than 200 KB? Why is this happening?