Can anyone explain this tcpdump question?

Please look at the third line that the windows size is 257, but in the fourth line it sends 992 bytes. Can anyone tell me why?

Thanks in advance!!!

Where are you seeing 992 bytes? [edit] I think you mean fourth line.

As I understand it, the window size doesn't fragment individual packets, that's what MTU's for... 992 bytes is small enough to fit in one packet, so...

Window scaling. Look at the opening tcp handshake for the wscale options. You then have to multiply the window sizes by 2^n where n is the wscale value.

Regards,
Alister

1 Like

Brillant!!!!!

How come I forget that :wall: