I'm capturing http traffic with tcpdump and am interested in TCP slow start and how window sizes increase:
我正在使用tcpdump捕获http流量,并且对TCP慢启动和窗口大小增加感兴趣:
$ sudo tcpdump -i eth1 -w wget++.tcpdump tcp and port 80
When I view the dump file with Wireshark the progression of window sizes looks normal, i.e. 5840, 5888, 5888, 8576, 11264, etc...
当我使用Wireshark查看转储文件时,窗口大小的进展看起来正常,即5840,5888,5888,8576,11264等......
But when I view the dump file via
但是当我查看转储文件时
$ tcpdump -r wget++.tcpdump -tnN | less
I get what seem to be nonsensical windows sizes ( IP addresses omitted for brevity ):
我得到了似乎毫无意义的窗口大小(为简洁省略了IP地址):
: S 1069713761:1069713761(0) win 5840 <mss 1460,sackOK,timestamp 24220583 0,nop,wscale 7>
: S 1198053215:1198053215(0) ack 1069713762 win 5672 <mss 1430,sackOK,timestamp 2485833728 24220583,nop,wscale 6>
: . ack 1 win 46 <nop,nop,timestamp 24220604 2485833728>
: . 1:1419(1418) ack 1 win 46 <nop,nop,timestamp 24220604 2485833728>
: P 1419:2002(583) ack 1 win 46 <nop,nop,timestamp 24220604 2485833728>
: . ack 1419 win 133 <nop,nop,timestamp 2485833824 24220604>
: . ack 2002 win 178 <nop,nop,timestamp 2485833830 24220604>
Is there a way to get normal / absolute window sizes on the command line?
有没有办法在命令行上获得正常/绝对窗口大小?
2 个解决方案
#1
9
The window sizes are correct - they're just unscaled.
窗口大小是正确的 - 它们只是未缩放。
The connection initiator has set a wscale (window scaling factor) of 7, so its subsequent win values must be multiplied by 128 to get the window size in bytes. Thus the win 46 indicates a window of 5888 bytes.
连接启动器已将wscale(窗口缩放系数)设置为7,因此其后续的win值必须乘以128才能获得以字节为单位的窗口大小。因此,胜利46表示5888字节的窗口。
The connection recipient has set a wscale of 6, so its win values must be multiplied by 64. Thus win 133 indicates a window of 8512 bytes, and win 178 indicates 11392 bytes.
连接接收者已将wscale设置为6,因此其win值必须乘以64.因此,win 133表示8512字节的窗口,win 178表示11392字节。
#2
3
Also, if the tool (wireshark or tcpdump, it doesn't matter) doesn't see the syn, it has to print the unscaled value, which can fool you
此外,如果工具(wireshark或tcpdump,无关紧要)没有看到syn,它必须打印未缩放的值,这可以欺骗你
#1
9
The window sizes are correct - they're just unscaled.
窗口大小是正确的 - 它们只是未缩放。
The connection initiator has set a wscale (window scaling factor) of 7, so its subsequent win values must be multiplied by 128 to get the window size in bytes. Thus the win 46 indicates a window of 5888 bytes.
连接启动器已将wscale(窗口缩放系数)设置为7,因此其后续的win值必须乘以128才能获得以字节为单位的窗口大小。因此,胜利46表示5888字节的窗口。
The connection recipient has set a wscale of 6, so its win values must be multiplied by 64. Thus win 133 indicates a window of 8512 bytes, and win 178 indicates 11392 bytes.
连接接收者已将wscale设置为6,因此其win值必须乘以64.因此,win 133表示8512字节的窗口,win 178表示11392字节。
#2
3
Also, if the tool (wireshark or tcpdump, it doesn't matter) doesn't see the syn, it has to print the unscaled value, which can fool you
此外,如果工具(wireshark或tcpdump,无关紧要)没有看到syn,它必须打印未缩放的值,这可以欺骗你