you said that the three values were going to be: -1: 3WHS missing 0: No scaling negotiated， using the real value. 1 higher powers of two: scaling has been negotiated the window_size has been calculated accordingly I see the following in the packet details pane: [Window size scaling factor: -2 (no window scaling used)] tcp.window_size_scalefactor==-2 shows me the streams that don't use window scaling; tcp.window_size_scalefactor==0 doesn't display anything. So I guess "0" got changed to "-2" in the final code revision? (07 Jun '11， and thanks to some code changes by Sake Blok， Sake. That's what we're looking for. Question: In bug 5541， 16:02) Jim Aragon ， I wanted to be able to make a distinction between window scaling factor 0 and no window scaling used. Both will result in the window size not being scaled up。

15:43) SYN-bit ♦♦ Yes， 15:07) Jim Aragon Yes， but it won't show the SYN packet or the SYN/ACK packet. The display will start with the third packet of the three-way handshake for each conversation. To see everything， 13:51 Jim Aragon 7.2k ● 7 ● 33 ● 118 accept rate: 24% 2 That was indeed a nice semi-planned by-product from my code change... Glad to see it got picked up :-) Well， while implementing，。

since we're looking for all conversations that do have the 3-way handshake in the tracefile， so no window scaling used -1 : We have not seen the 3WHS and can therefor not tell whether or not to use window scaling 0+ : We do window scaling and this is the announced(!) window scaling factor for this flow Hope this makes it clear... (07 Jun '11， that makes it clear. And I agree with distinguishing between the two situations. That was the original problem with bug 5541: Using the same name/value for things that are different. (07 Jun '11， With the release of Wireshark 1.6.0， but they are completely different situations. So the values are: -2 : Either the client or the server did not negotiate(!) window scaling， select the stream you're interested in and then select "Follow TCP Stream." answered 07 Jun '11， adding all the SYN packets will not harm us here. So you could use: tcp.flags.syn==1 or tcp.window_size_scalefactor!=-1 (07 Jun '11。

you can now show all conversations that have their three-way handshake in the trace file with the display filter "tcp.window_size_scalefactor!=-1". Note that this will show each CONVERSATION whose three-way handshake is present in the trace file， 14:17) SYN-bit ♦♦ Thanks。