> > Since the TCP Window Scale options are exchanged, > > the window size field contains shifted value except SYNs. > > Be careful, tcpdump may be tracking the window scale and reporting > scaled values. Seems unlikely since with a window scale of 2, and odd > window size would be impossible. I am sorry if tcpdump tracks the window scale option. But I think it is unlikely, because there are odd window sizes, as you pointed out. By the way, if tcpdump does not track the window scale option, the right edge (ack + real win) does not change between the following two ACKs. > 11:34:54.337167 10.2.20.246.33060 > 10.2.224.182.8700: . ack 84402527 win 15340 <nop,nop,timestamp 226080473 99717814> (DF) (259 ACKs are omitted here) > 11:34:54.611769 10.2.20.246.33060 > 10.2.224.182.8700: . ack 84454467 win 2355 <nop,nop,timestamp 226080721 99717841> (DF) The first line is the 37th ACK and the second line is the 295th ACK. ACK#37: ack=84402527 win=15340 right_edge=84463887 (= ack + win * 4) ACK#295: ack=84454467 win=2355 right_edge=84463887 (= ack + win * 4) And all ACKs later than ACK#295 has win=2355 (2355*4=9420). This may be a hint. But, sorry, I do not know the internal of Linux TCP. Regards, Noritoshi Demizu - : send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
