Wireshark mailing list archives
Re: TCP connection window size change question
From: Andrew Hood <ajhood () fl net au>
Date: Sat, 24 Jul 2010 08:51:31 +1000
George Vandelet wrote:
Wireshark superusers, I have been looking at captures and many times I see at the end of an TCP HTTP session a TCP packet (or series of TCP packets) that looks to (in wireshark) change the window size. Why does wireshark show that the window size changes right before the TCP session is closed? It does not make sense to change the window size after the first FIN,ACK ->ACK exchange has been done as there is nothing to do after that except for close the connection with the following FIN,ACK ->ACK!
Just because one end has sent a FIN it does not mean the other end has finished sending. A half-close causes a FIN, but does not stop the program from reading data coming back. Hence reporting window size changes is still appropriate. -- There's no point in being grown up if you can't be childish sometimes. -- Dr. Who ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- TCP connection window size change question George Vandelet (Jul 23)
- Re: TCP connection window size change question Andrew Hood (Jul 23)