[RFC] A patch to set TCP window scaling when options weren't captured

[Martin Mathieson <martin.r.mathieson () googlemail com>]

This was discussed a little bit at Sharkfest.

I often need to analyse TCP streams where I only see part of a very long
TCP session, not including the initial options where window scaling was set
(but where I know the scaling because of other, very similar runs).

Without knowing the proper scaling factor, we still see Zero-Window coming
from the receiving side, but no longer see the Window-Full detection on the
sending side.  We won't see the correct available window in TCP stream
graphs.

The attached patch uses a TCP dissector preference to set a single scaling
factor value to use for any flow where the signalled scaling option hasn't
been captured.  When applied, it says in the item for 'Window size scaling
factor' that it is derived from a preference.

If the scaling option is dissected, this preference setting is ignored.

The default value for this preference is 'not-known', in which case current
behaviour doesn't change.


I would welcome comments on the approach, and on the posted patch.  If
there are no strong objections I will submit in a few days.
Thanks,
Martin

Attachment: pref_for_window_scaling.diff
Description:

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe