nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

TCP Windows

new2net

Hey everyone,

Just had a quick question on TCP Windows. I'm looking at a capture and it goes something like this:

Packet 1 (from client):

Seq=1, ACK=480, Window=256, Len=0

Packet 2 (from server):

Seq=480, ACK=1, Window=260, Len=540

The connection has already been established and I'm just focusing on some of the actual data flow. In this example, the client sets a window size of 256. This tells the server that it can send 256 bytes before having to wait for an acknowledgement. If this is the case, why does the server respond with 540 bytes instead of 256?

The entire capture shows similar data. It appears the sender is sending more bytes than what is stated in the client window field. There aren't any discarded packets in the capture.

Any ideas?

Thank you.

Find more posts tagged with

SAVE $250 on Your CISCO Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View CISCO Boot Camps

Comments

mikeybinec

The server is saying I can accept this size

new2net

Why is the server sending 540 bytes when the client sets a window of 256?

mikeybinec

If the server sends back an ACK and if there are no errors, the client/host can increase the window size

Odom, pg 141

SteveO86

new2net wrote: »

Why is the server sending 540 bytes when the client sets a window of 256?

Does either end support window scaling? (Pretty much all clients nowadays support window scaling)

Without seeing all the TCP Options during the 3-way handshake it's hard to say.

Also as mentioned below, when ever data is successfully Ack'ed without packet loss the window size will grow.

new2net

mikeybinec wrote: »

If the server sends back an ACK and if there are no errors, the client/host can increase the window size

Odom, pg 141

That isn't exactly what I'm asking...

When the client sends packet 1 to the server, the window value indicates that the server may send 256 bytes before it needs to wait for an ACK. So why then does the server send 540 bytes when the client tells it to only send 256?

new2net

SteveO86 wrote: »

Does either end support window scaling? (Pretty much all clients nowadays support window scaling)

Hey Steve,

No scaling is being used...