0

i know that the receiver machine's window size can be calculated like this:

In the SYN package: (2 ^ wscale) * win. According to tcpdump output the initial window size is:

(2 ^ 7) * 64240

128 * 64240 = 8222720 Byte Window Size.

Please have a look at the tcpdump output. The receiver will reduce the window size after a while. However, the sender is still sending packets larger than the recipient's window size.

I have tried a couple of different receiver-sender. It is same for other servers as well.

If the receiver's window size gets smaller, I would expect the sender to send smaller packets. Because the receiver's window size is reduced for the particular connection.

09:48:39.015725 IP receiver.54054 > sender.https: Flags [S], seq 1577157532, win 64240, options [mss 1460,sackOK,TS val 249770150 ecr 0,nop,wscale 7], length 0
09:48:39.029798 IP sender.https > receiver.54054: Flags [S.], seq 4199004706, ack 1577157533, win 65160, options [mss 1460,sackOK,TS val 4265502142 ecr 249770150,nop,wscale 7], length 0
09:48:39.029816 IP receiver.54054 > sender.https: Flags [.], ack 1, win 502, options [nop,nop,TS val 249770164 ecr 4265502142], length 0
09:48:39.030249 IP receiver.54054 > sender.https: Flags [P.], seq 1:418, ack 1, win 502, options [nop,nop,TS val 249770165 ecr 4265502142], length 417
09:48:39.044327 IP sender.https > receiver.54054: Flags [.], ack 418, win 506, options [nop,nop,TS val 4265502156 ecr 249770165], length 0
09:48:39.045664 IP sender.https > receiver.54054: Flags [P.], seq 1:2897, ack 418, win 506, options [nop,nop,TS val 4265502158 ecr 249770165], length 2896
09:48:39.045664 IP sender.https > receiver.54054: Flags [P.], seq 2897:4097, ack 418, win 506, options [nop,nop,TS val 4265502158 ecr 249770165], length 1200
09:48:39.045679 IP receiver.54054 > sender.https: Flags [.], ack 2897, win 480, options [nop,nop,TS val 249770180 ecr 4265502158], length 0
09:48:39.045690 IP receiver.54054 > sender.https: Flags [.], ack 4097, win 471, options [nop,nop,TS val 249770180 ecr 4265502158], length 0
09:48:39.048465 IP sender.https > receiver.54054: Flags [P.], seq 4097:4592, ack 418, win 506, options [nop,nop,TS val 4265502161 ecr 249770165], length 495
09:48:39.048471 IP receiver.54054 > sender.https: Flags [.], ack 4592, win 491, options [nop,nop,TS val 249770183 ecr 4265502161], length 0
09:48:39.051706 IP receiver.54054 > sender.https: Flags [P.], seq 418:498, ack 4592, win 501, options [nop,nop,TS val 249770186 ecr 4265502161], length 80
09:48:39.065764 IP sender.https > receiver.54054: Flags [.], ack 498, win 506, options [nop,nop,TS val 4265502178 ecr 249770186], length 0
09:48:39.065778 IP receiver.54054 > sender.https: Flags [P.], seq 498:707, ack 4592, win 501, options [nop,nop,TS val 249770200 ecr 4265502178], length 209
09:48:39.065958 IP sender.https > receiver.54054: Flags [P.], seq 4592:4895, ack 498, win 506, options [nop,nop,TS val 4265502178 ecr 249770186], length 303
09:48:39.065962 IP receiver.54054 > sender.https: Flags [.], ack 4895, win 499, options [nop,nop,TS val 249770200 ecr 4265502178], length 0
09:48:39.066043 IP sender.https > receiver.54054: Flags [P.], seq 4895:5198, ack 498, win 506, options [nop,nop,TS val 4265502178 ecr 249770186], length 303
09:48:39.066049 IP receiver.54054 > sender.https: Flags [.], ack 5198, win 497, options [nop,nop,TS val 249770201 ecr 4265502178], length 0
09:48:39.079832 IP sender.https > receiver.54054: Flags [.], ack 707, win 505, options [nop,nop,TS val 4265502192 ecr 249770200], length 0
09:48:39.137940 IP sender.https > receiver.54054: Flags [P.], seq 5198:8094, ack 707, win 505, options [nop,nop,TS val 4265502250 ecr 249770201], length 2896
09:48:39.137940 IP sender.https > receiver.54054: Flags [P.], seq 8094:10990, ack 707, win 505, options [nop,nop,TS val 4265502250 ecr 249770201], length 2896
tonny
  • 1
  • 1
  • You seem to be misreading the dump. There are no segments even approaching such a window size. The largest segments have `length 2896`, which is considerably smaller than your calculated window size. – Ron Maupin Jul 12 '22 at 12:40
  • @RonMaupin Thank you very much for your reply. I mean, the receiver sent an ack with `win` value of `497` at `09:48:39.066049`. I'm assuming, it means "hey, I only have 497 bytes of buffer for this TCP connection." However, the sender ignored the receiver's current window size (`497` bytes) and sent `2894` bytes of data to the receiver at `09:48:39.079832`. Why doesn't the sender send a package to the receiver that is smaller than the receiver's available buffer? This confuses me. Thank you for your help – tonny Jul 12 '22 at 13:03

0 Answers0