Re: "Window" field - TCP packet
Hi Dale, you can find a copy of Ethepeek/Tokenpeek on every CD that comes in the Sybex Todd Lammle books. Old CCNA 1.0, ACRC books in particular. Hope you get the lab on first try. :>) Dale CCNA _ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com. _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: "Window" field - TCP packet
Hmm, sounds like I need to dust off my old copy of Visual Studio (and my brain) and bang this utility out. Maybe after I pass the lab. No, then I've got the design lab to prepare for (have you heard anything about that???)... Maybe someone else better do it... Seriously - I agree that it would be a cool tool! I didn't know that EtherPeek would let you capture and view the decode at the same time - that is really cool! I need that now... I better take a look that EtherPeek. Does it run only on a Mac? Dale [=`) >From: Priscilla Oppenheimer <[EMAIL PROTECTED]> >Reply-To: Priscilla Oppenheimer <[EMAIL PROTECTED]> >To: [EMAIL PROTECTED] >Subject: Re: "Window" field - TCP packet >Date: Tue, 17 Oct 2000 14:12:05 -0700 > >Nice answer, Dale. > >Do you think he was literally asking for a utility that would show the >window size as a station was transmitting? That would be quite useful >actually... > >EtherPeek from www.WildPackets.com (used to be AG Group) lets you capture >and display packets at the same time. So you could filter on your station >and its partner and track windows that way. You could see the receive >window rather easily, since it's size is advertised on every segment. The >send window would be harder, requiring an analysis of sequence numbers and >the other side's receive window. > >But I can't think of a utility that graphically shows send and receive >windows for a transmitter. That would be really cool, wouldn't it? > >Priscilla > > >At 03:55 PM 10/17/00, Dale Holmes wrote: >>Each station in a TCP conversation will advertise a window which >>represents the amount of buffer space that the station has available for >>this conversation. The window size of a packet is the buffer available for >>the station that is sending the packet, indicating to the recipient how >>much data to send. >> >>It is called a "sliding window" because it is variable and will change >>throughout the course of the conversation. >> >>For more detail on this, I would look at Douglas Comer's "Internetworking >>with TCP/IP" volume I. >> >>I have not seen a utility that will display the window size during the >>transmission of the packet. A sniffer will display all of the packet >>fields, but only after you have captured the transfer and opted to display >>it (but of course you knew that already)... >> >>Dale >>[=`) >> >> >>>From: "Billy Monroe" <[EMAIL PROTECTED]> >>>Reply-To: "Billy Monroe" <[EMAIL PROTECTED]> >>>To: [EMAIL PROTECTED] >>>Subject: "Window" field - TCP packet >>>Date: Tue, 17 Oct 2000 12:05:12 -0700 >>> >>>Hello: >>> >>>Is there any way to see the size of the (sliding) window when transmiting >>>a >>>TCP packet ? >>> >>>I saw a "Window" field using a sniffer and the number was big 28765... >>>Please correct me if I am wrong: I believe that is the buffer of the >>>receiving station. >>> >>>Thanks, >>> >>>Ronaldo >>> >>> >>> >>>_ >>>FAQ, list archives, and subscription info: >>>http://www.groupstudy.com/list/cisco.html >>>Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] >> >>_ >>Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. >> >>Share information about yourself, create your own public profile at >>http://profiles.msn.com. >> >>_ >>FAQ, list archives, and subscription info: >>http://www.groupstudy.com/list/cisco.html >>Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] > > > > >Priscilla Oppenheimer >http://www.priscilla.com > >_ >FAQ, list archives, and subscription info: >http://www.groupstudy.com/list/cisco.html >Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] _ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com. _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: "Window" field - TCP packet
So what. We aren't talking about packet size. We're talking about window size. At 07:54 PM 10/17/00, Pradeep Kumar wrote: >Priscilla , Dale, > >I spend at least 2 hours per day on Etherpeek for troubleshooting and >analysing network recreates. > >There is an option for bargraph/pie chart of the Packet size distribution >which I use to see " what density of what size packets " in one scan of >the eye in real time. > >I am using Etherpeek 3.6 > >Kumar > > > > >-Original Message- >From:Priscilla Oppenheimer [EMAIL PROTECTED] >Sent: Tue, 17 Oct 2000 14:12:05 -0700 >To: [EMAIL PROTECTED] >Subject: Re: "Window" field - TCP packet > > >Nice answer, Dale. > >Do you think he was literally asking for a utility that would show the >window size as a station was transmitting? That would be quite useful >actually... > >EtherPeek from www.WildPackets.com (used to be AG Group) lets you capture >and display packets at the same time. So you could filter on your station >and its partner and track windows that way. You could see the receive >window rather easily, since it's size is advertised on every segment. The >send window would be harder, requiring an analysis of sequence numbers and >the other side's receive window. > >But I can't think of a utility that graphically shows send and receive >windows for a transmitter. That would be really cool, wouldn't it? > >Priscilla > > >At 03:55 PM 10/17/00, Dale Holmes wrote: > >Each station in a TCP conversation will advertise a window which > >represents the amount of buffer space that the station has available for > >this conversation. The window size of a packet is the buffer available for > >the station that is sending the packet, indicating to the recipient how > >much data to send. > > > >It is called a "sliding window" because it is variable and will change > >throughout the course of the conversation. > > > >For more detail on this, I would look at Douglas Comer's "Internetworking > >with TCP/IP" volume I. > > > >I have not seen a utility that will display the window size during the > >transmission of the packet. A sniffer will display all of the packet > >fields, but only after you have captured the transfer and opted to display > >it (but of course you knew that already)... > > > >Dale > >[=`) > > > > > >>From: "Billy Monroe" <[EMAIL PROTECTED]> > >>Reply-To: "Billy Monroe" <[EMAIL PROTECTED]> > >>To: [EMAIL PROTECTED] > >>Subject: "Window" field - TCP packet > >>Date: Tue, 17 Oct 2000 12:05:12 -0700 > >> > >>Hello: > >> > >>Is there any way to see the size of the (sliding) window when transmiting a > >>TCP packet ? > >> > >>I saw a "Window" field using a sniffer and the number was big 28765... > >>Please correct me if I am wrong: I believe that is the buffer of the > >>receiving station. > >> > >>Thanks, > >> > >>Ronaldo > >> > >> > >> > >>_ > >>FAQ, list archives, and subscription info: > >>http://www.groupstudy.com/list/cisco.html > >>Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] > > > >_ > >Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. > > > >Share information about yourself, create your own public profile at > >http://profiles.msn.com. > > > >_ > >FAQ, list archives, and subscription info: > >http://www.groupstudy.com/list/cisco.html > >Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] > > > > >Priscilla Oppenheimer >http://www.priscilla.com > >_ >FAQ, list archives, and subscription info: >http://www.groupstudy.com/list/cisco.html >Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] > > > >___ >Visit http://www.visto.com/info, your free web-based communications center. >Visto.com. Life on the Dot. Priscilla Oppenheimer http://www.priscilla.com _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: "Window" field - TCP packet
Priscilla , Dale, I spend at least 2 hours per day on Etherpeek for troubleshooting and analysing network recreates. There is an option for bargraph/pie chart of the Packet size distribution which I use to see " what density of what size packets " in one scan of the eye in real time. I am using Etherpeek 3.6 Kumar -Original Message- From:Priscilla Oppenheimer [EMAIL PROTECTED] Sent:Tue, 17 Oct 2000 14:12:05 -0700 To: [EMAIL PROTECTED] Subject: Re: "Window" field - TCP packet Nice answer, Dale. Do you think he was literally asking for a utility that would show the window size as a station was transmitting? That would be quite useful actually... EtherPeek from www.WildPackets.com (used to be AG Group) lets you capture and display packets at the same time. So you could filter on your station and its partner and track windows that way. You could see the receive window rather easily, since it's size is advertised on every segment. The send window would be harder, requiring an analysis of sequence numbers and the other side's receive window. But I can't think of a utility that graphically shows send and receive windows for a transmitter. That would be really cool, wouldn't it? Priscilla At 03:55 PM 10/17/00, Dale Holmes wrote: >Each station in a TCP conversation will advertise a window which >represents the amount of buffer space that the station has available for >this conversation. The window size of a packet is the buffer available for >the station that is sending the packet, indicating to the recipient how >much data to send. > >It is called a "sliding window" because it is variable and will change >throughout the course of the conversation. > >For more detail on this, I would look at Douglas Comer's "Internetworking >with TCP/IP" volume I. > >I have not seen a utility that will display the window size during the >transmission of the packet. A sniffer will display all of the packet >fields, but only after you have captured the transfer and opted to display >it (but of course you knew that already)... > >Dale >[=`) > > >>From: "Billy Monroe" <[EMAIL PROTECTED]> >>Reply-To: "Billy Monroe" <[EMAIL PROTECTED]> >>To: [EMAIL PROTECTED] >>Subject: "Window" field - TCP packet >>Date: Tue, 17 Oct 2000 12:05:12 -0700 >> >>Hello: >> >>Is there any way to see the size of the (sliding) window when transmiting a >>TCP packet ? >> >>I saw a "Window" field using a sniffer and the number was big 28765... >>Please correct me if I am wrong: I believe that is the buffer of the >>receiving station. >> >>Thanks, >> >>Ronaldo >> >> >> >>_ >>FAQ, list archives, and subscription info: >>http://www.groupstudy.com/list/cisco.html >>Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] > >_ >Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. > >Share information about yourself, create your own public profile at >http://profiles.msn.com. > >_ >FAQ, list archives, and subscription info: >http://www.groupstudy.com/list/cisco.html >Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] Priscilla Oppenheimer http://www.priscilla.com _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] ___ Visit http://www.visto.com/info, your free web-based communications center. Visto.com. Life on the Dot. _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: "Window" field - TCP packet
Nice answer, Dale. Do you think he was literally asking for a utility that would show the window size as a station was transmitting? That would be quite useful actually... EtherPeek from www.WildPackets.com (used to be AG Group) lets you capture and display packets at the same time. So you could filter on your station and its partner and track windows that way. You could see the receive window rather easily, since it's size is advertised on every segment. The send window would be harder, requiring an analysis of sequence numbers and the other side's receive window. But I can't think of a utility that graphically shows send and receive windows for a transmitter. That would be really cool, wouldn't it? Priscilla At 03:55 PM 10/17/00, Dale Holmes wrote: >Each station in a TCP conversation will advertise a window which >represents the amount of buffer space that the station has available for >this conversation. The window size of a packet is the buffer available for >the station that is sending the packet, indicating to the recipient how >much data to send. > >It is called a "sliding window" because it is variable and will change >throughout the course of the conversation. > >For more detail on this, I would look at Douglas Comer's "Internetworking >with TCP/IP" volume I. > >I have not seen a utility that will display the window size during the >transmission of the packet. A sniffer will display all of the packet >fields, but only after you have captured the transfer and opted to display >it (but of course you knew that already)... > >Dale >[=`) > > >>From: "Billy Monroe" <[EMAIL PROTECTED]> >>Reply-To: "Billy Monroe" <[EMAIL PROTECTED]> >>To: [EMAIL PROTECTED] >>Subject: "Window" field - TCP packet >>Date: Tue, 17 Oct 2000 12:05:12 -0700 >> >>Hello: >> >>Is there any way to see the size of the (sliding) window when transmiting a >>TCP packet ? >> >>I saw a "Window" field using a sniffer and the number was big 28765... >>Please correct me if I am wrong: I believe that is the buffer of the >>receiving station. >> >>Thanks, >> >>Ronaldo >> >> >> >>_ >>FAQ, list archives, and subscription info: >>http://www.groupstudy.com/list/cisco.html >>Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] > >_ >Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. > >Share information about yourself, create your own public profile at >http://profiles.msn.com. > >_ >FAQ, list archives, and subscription info: >http://www.groupstudy.com/list/cisco.html >Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] Priscilla Oppenheimer http://www.priscilla.com _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: "Window" field - TCP packet
When sending a packet (segment), a station includes in the TCP header the current size of its receive window. In your example, the sender is saying that its receive window is 28765 bytes. The station is saying, "you can send me 28765 bytes without stopping and waiting for an acknowledgement." That's about 20 1500-byte packets. That's not really very big when you consider the low cost of memory these days. (Buffer size is based on available memory.) If you study a protocol analyzer trace, you may see the receive window size shrink as the station's receive buffers start to fill up. Probably an application will come along, though, and grab the received bytes, clearing up space in the buffer. So the station will acknowledge some data and slide its window back open. You can see evidence of the sending window also by tracking TCP sequence numbers. The size of the sending window is determined by the recipient's receive window. It's easier to just track receive windows because a station explicitly specifies the number of bytes in its receive window on every packet it sends. Priscilla At 12:05 PM 10/17/00, Billy Monroe wrote: >Hello: > >Is there any way to see the size of the (sliding) window when transmiting a >TCP packet ? > >I saw a "Window" field using a sniffer and the number was big 28765... >Please correct me if I am wrong: I believe that is the buffer of the >receiving station. > >Thanks, > >Ronaldo > > > >_ >FAQ, list archives, and subscription info: >http://www.groupstudy.com/list/cisco.html >Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] Priscilla Oppenheimer http://www.priscilla.com _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Re: "Window" field - TCP packet
Each station in a TCP conversation will advertise a window which represents the amount of buffer space that the station has available for this conversation. The window size of a packet is the buffer available for the station that is sending the packet, indicating to the recipient how much data to send. It is called a "sliding window" because it is variable and will change throughout the course of the conversation. For more detail on this, I would look at Douglas Comer's "Internetworking with TCP/IP" volume I. I have not seen a utility that will display the window size during the transmission of the packet. A sniffer will display all of the packet fields, but only after you have captured the transfer and opted to display it (but of course you knew that already)... Dale [=`) >From: "Billy Monroe" <[EMAIL PROTECTED]> >Reply-To: "Billy Monroe" <[EMAIL PROTECTED]> >To: [EMAIL PROTECTED] >Subject: "Window" field - TCP packet >Date: Tue, 17 Oct 2000 12:05:12 -0700 > >Hello: > >Is there any way to see the size of the (sliding) window when transmiting a >TCP packet ? > >I saw a "Window" field using a sniffer and the number was big 28765... >Please correct me if I am wrong: I believe that is the buffer of the >receiving station. > >Thanks, > >Ronaldo > > > >_ >FAQ, list archives, and subscription info: >http://www.groupstudy.com/list/cisco.html >Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] _ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com. _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
