Fixing Window Scaling Analysis Issues Wireshark 2.0<br />When analyzing packets its important to get it right. I spend a lot of time explaining to people that the TCP handshake is critical to capture since some information you might need is only seen there.<br />Items that would be an example of this are; TCP MSS, SACK Permitted and TCP Scaling Option values. The TCP window scaling option is used to increase the TCP receive window size past its maximum value of 65,535 bytes.<br />If you’ve ever analyzed a trace where the TCP Scaling option was used but you did not have the TCP 3 way handshake in that trace, you will see weird TCP Window Size values.<br />With Wireshark 2.0, you can tell Wireshark what the scaling option or factor is and not the TCP Window sizes will be accurate.<br />In this video I show you the trace file with a scaling option, then I remove the scaling option to show you what the TCP window size now looks like, finally I show you how to use the Protocol Preferences option to tell Wireshark what scaling option to use.<br /><br /><br /><br />Lovemytool Blog: <a href="http://www.lovemytool.com/blog/tony-fortunato/" target="_blank" rel="nofollow">http://www.lovemytool.com/blog/tony-fortunato/</a><br />Network Computing Blog: <a href="http://www.networkcomputing.com/author-bio.asp?author_id=2332" target="_blank" rel="nofollow">http://www.networkcomputing.com/author-bio.asp?author_id=2332</a><br />Garland Technology Blog: <a href="http://www.garlandtechnology.com/blog/author/tony-fortunato" target="_blank" rel="nofollow">http://www.garlandtechnology.com/blog/author/tony-fortunato</a><br />Youtube Channel: <a href="http://www.youtube.com/user/thetechfirm" target="_blank" rel="nofollow">http://www.youtube.com/user/thetechfirm</a><br />NEW: <a href="http://www.thetechfirm.tv" target="_blank" rel="nofollow">http://www.thetechfirm.tv</a><br />Google Plus: <a href="http://plus.google.com/+Thetechfirmplus" target="_blank" rel="nofollow">http://plus.google.com/+Thetechfirmplus</a> <br />Network Computing Articles: <a href="http://tinyurl.com/h8orh26" target="_blank" rel="nofollow">http://tinyurl.com/h8orh26</a><br />...<br /><a href="https://www.youtube.com/watch?v=INdkjcLTHfk" target="_blank" rel="nofollow">https://www.youtube.com/watch?v=INdkjcLTHfk</a>