View Source: TcpWindow - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages

For a [TCP] connection, each side keeps track of how much data the other side is capable of receiving into its buffers. This is called the __window__, and the TCP header has a field for reporting the window to the other end. The window size/sequence numbers are measured in octets (8-bit bytes).

You can think of the window as continously sliding to the right, as the sequence numbers increase. If the OperatingSystem has more space available for buffering packets, the right-hand-side of the window will increase faster than the left-hand-side and the window becomes wider. If the left-hand-side of the window increases faster, then the window will shrink.

The right-hand-side should never decrease in value. If this happens, then it is either caused by a buggy TCP implementation, or is a malicious attempt to confuse your networking stack.
The LinuxKernel's network stack will detect this and print something like
<verbatim>
kernel: TCP: Treason uncloaked! Peer 200.108.65.161:62710/80
  shrinks window 2077733939:2077733940. Repaired.
</verbatim>
to syslogd(8).

(thanks to Kragen Sitaker for the explanation)

2 pages link to TcpWindow:

Last edited on Friday, May 27, 2005 11:04:32 am by JohnMcPherson

Edit PageHistory Diff Info LikePages