And in fairness to Ethereal... I upgraded from 0.9.6 to 0.9.8 today (just released a week or so ago). Now, when the handshake takes place, instead of just showing you the hex value for scale, Ethereal tells you to (multiply by x), where x is whatever decimal value being offered/requested.
Also, some of you probably caught me in a lie. MSS is four bytes and SACK permitted is 2. I'll shut up now. s vermill wrote: > > Group: > > Thanks again for all of the additional input. I owe you this > follow-up because I had some things wrong last night. Here, I > hope, is much better information: > > On the drive home last night, it began to bother me that > Ethereal was only showing 4 bytes of options in my outgoing > syns (1 byte MSS, 2 bytes NOP, and 1 byte SACK Permitted). It > seemed that the developers would have had to have gone to great > trouble to strip out the RFC1323 options in the capture and > still have the checksum pass. Why bother? Hmmm... > > I recaptured a download test from pcpitstop. Sure enough, the > web server was having my machine report its value for > MaxTcpWindowSize so that the web server could turn right back > around and plug it into the "results" being displayed on my > machine. Alas, I was not actually opening an rcv window above > 65535. It was all smoke and mirrors. > > I had read several times that RFC1323 window scaling was > enabled by default in W2k and newer OSes. Turns out, it will > accept offers by default, but not make any of its own. That > is, until you create the DWORD value Tcp1323Opts under the > \tcpip\parameters key and set it appropriately (url to follow). > > Furthermore, TcpWindowSize is still intended to be mainly used > as a per-interface parameter. GlobalMaxTcpWindowSize enforces > a global limit that no interface can exceed. So, setting the > two at the same value under \tcpip\parameters, or just > TcpWindowSize alone under the same, along with Tcp1323Opts set > appropriately, actually enables window scaling. > > Sure enough, my Ethereal capture now reflects 28 bytes of > options, including an offer to window scale. The scale value > offered tracks exactly what I would expect based on my various > TcpWindowSize experiments. So, although Ethereal doesn't > "support" window scaling in that it still reflects the 16-bit > value in the "normal" (non-handshake) data segments, you can > track back to the original "syn, syn-ack, ack" handshake in the > trace file and do the math yourself (assuming, of course, that > the distant-end accepted the offer to scale!). > > And here is more about the MS TCP stack for W2k than you ever > wanted to know (Appendix A has all the relevant DWORDS and > their valid ranges): > > http://www.microsoft.com/windows2000/docs/tcpip2000.doc > > You can even enable MTU discovery on your W2k box?! > > Regards all, > > Scott > Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=59499&t=59487 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
