Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my LAN, I have a router that runs a Samba server and my PC connects to the router.

I wiresharked during uploading a file from my PC to the samba server.

Below is a shortcut of the wireshark result,

enter image description here

As can be seen, after server's reply in frame 7560, my PC sends several packets which are all full sized(frame with 1514 bytes).

enter image description here

But in frame 7560, the advertised window size is 94 bytes.

And the above situation happens throughout the results.

So, what I cannot understand is how can my PC sends almost 30000+ bytes while the last packets from the server only advertise a 94 bytes window.

share|improve this question

Window size is affected by network buffer size, the default setting in Linux 2.6 should be fine, in case the network buffer is too small, use following recommded value for Gigabit Ethernet

sysctl -w net.ipv4.tcp_rmem="40960       1048560 4194304"
sysctl -w net.ipv4.tcp_wmem="40960       196608  4194304"
sysctl -w net.core.rmem_max=4194304
sysctl -w net.core.wmem_max=4194304

more details

You can use iperf to detect window size, if it reports fine for server's local NIC, then it might be issue with the router or app

share|improve this answer
While it is nice to know how to detect or change the window size, the questioner originally aimed at to why the window size advertised in frame 7560 has been exceeded by several magnitudes by the sending party. – the-wabbit Jan 10 '12 at 23:38

I would think this is TCP Window Scaling at work - it probably has been negotiated at connection setup and is not taken into account by Wireshark. So the advertised window size is not 94 Bytes but (2^ x) * 94 where x is the scaling factor.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.