I have been doing some reading into TCP Receive Window (RWIN), Maximum Segment Size (MSS) and Maximum Transmission Unit (MTU). Right off the bat I have some questions and I need a power user's help!
The following questions are based on my using of Wireshark with a Win7 client to view the frames in a TCP stream:
- Where do you look (in the TCP stream) to find the RWIN in use? Is it the SYN, SYN-ACK, or ACK? I am under the impression it is in the SYN packet of the 3-way handshake.
- What is the remote machine saying by a "Window Size Value" of 16425, and a "Calculated window size" of 65700 (Wireshark states a scaling factor of 4, i.e. 16425 * 4 = 65700) in the ACK packet?
- Which machine dictates the RWIN value used during transmission - the client or remote machine?
- As per TCP connection termination there is a FIN-ACK which indicates the remote machine wants to terminate the connection followed by an ACK from the client and then an RST-ACK again by the client thus closing the connection. Does the RWIN value in the FIN-ACK and ACK packets during this termination process have any significance because they are very different from the RWIN values stated in the 3-way handshake?
I have some more questions but answer here may have a bearing on them so I shall wait for some answers first :)