Wireshark TCP Window Size Value

Posted by T Vernon on Server Fault See other posts from Server Fault or by T Vernon
Published on 2014-05-28T14:07:50Z Indexed on 2014/05/28 15:32 UTC
Read the original article Hit count: 119

Filed under:

I am debugging an application with Wireshark and watching the TCP Window Size value shrink on one side of the communication.

If the packet's TCP section shows a "Window size value: 1", does that mean the source's window size is 1 or the destination's window size is 1? I know one side is communicating faster than the other can handle, I just want be sure I know which one it is.

1 192.168.0.1 -> 192.168.0.100, Modbus/TCP, Length: 66, Window Size Value: 1

2 192.168.0.100 -> 192.168.0.1, TCP, Length: 60, Window Size Value: 92

3 192.168.0.100 -> 192.168.0.1 TCP, Length: 310, Window Size Value: 92

4 192.168.0.1 -> 192.168.0.100 TCP, Length: 54, Window Size Value: 0

So is 192.168.0.1's window size 0 or is it reporting that 192.168.0.100's window is 0? Thanks.

© Server Fault or respective owner

Related posts about wireshark