TCP Window Scaling on Wireshark

Question

i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken.

I have a dump file of some 110mb that i use for my graphs. This is the traffic between the system used for packet analysis and an FTP server where the initial system asked for a big file.

I have to show the graph for Window Scaling for the received windows that only came from FTP server and make some assumptions of their size.

My actions for Wireshark were to:

• load the dump file
• find the TCP 3-ack packets
• select the first tcp packet after this
• Go Statistics -> TCP Stream Graphs -> Window Scaling
• I get a blank window scaling window, the following:

• I then click 2 times the Stream, increasing from 0 to 2 and i get the following window scaling window:

The 147.102.222.211 is the FTP server and 195.251.211.87 is the initial system.

My questions are:

• How to restrict the received windows only to those coming from FTP server? Should i only leave the Rcv Win checkbox below checked?

• How to find out when / where in the graph that the received window size is more than 200 KB by just looking at those green dots in the top of graph?

• Why is the received window this size and not the default (i think) 65 KB ? It seems the majority is more than 200 KB? Why is this happening?

Answer 1

I think I need to explain a couple of terms first:

• Stream - this is a TCP conversation. Each TCP conversation gets a number assigned when its first packet is found by Wireshark when reading the file, so Stream 0 is the first TCP conversation, 1 the second, and 2 the third (which, in your case, is the FTP data transfer). A stream is bidirectional, so it includes packets for both nodes involved.

• Rcv Win - this checkbox tells the graph to paint the receive window value, which is what you're interested in, so it needs to be checked

• Bytes out - this checkbox tells the graph to paint the throughput into the graph, which are the blue dots in your case.

Okay, so let's see:

1. In your first screenshot you have stream 0, which is a HTTP stream and probably has only a single packet, which is why the graph is empty. It's a bit hard to tell without the capture file.

2. To answer your first question: to restrict the received window values only to those from the FTP server you need to select the correct stream (stream 2, as seen in your second screen shot), and THEN select the correct direction. This is because every node in a TCP connection has its own Window value, and your 2nd graph shows the data flow from the FTP server to the client (as you can tell by the -> arrow in the headline of the graph) - which means it shows the bytes from the server and the window value of the client, because they work together. If you want to see the window value of the server, click on the "Switch direction" button to see the other direction, where the client sends bytes and the server advertises its window size.

3. Second question: it looks like it peaks at about 250KB, as shown in the graph

4. the window size of 64kb (65535 bytes) is not a default anymore (as it was in earlier times) - it can grow much bigger (via TCP Window Scale option) and can also be kept much smaller, depending on what the requirements are. The window of ~250KB in your case is something the client uses because it calculated it to be the most efficient size for receiving data from the server. The calculation for the optimum window size is based on delay and throughput.