Wireshark - Understanding TCP window size

In this example, first 2 packets of the 3 way handshake show that both the client and the server set the window size to 8192 bytes. Notice the third packet of the 3 way handshake sets the Window Size to 534016 bytes. This means that both the client can receive up to 534,016 bytes of data from the server without needing to send an acknowledgment (ACK) to the server.


In this example, we can see the client Window size reached 0 in the last packet displayed. Once the window size was 0, the client PC was unable to receive the next packet from the server, because the payload in the next packet from the server exceeds the window size in the clients buffer.

The tcp.window_size==0 filter can be used to show only those packets that have a window size of zero.


Did you find this article helpful?

If so, consider buying me a coffee over at Buy Me A Coffee

Add a Comment

We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.

Please enter c36e2 in the box below so that we can be sure you are a human.


Web design by yours truely - me, myself, and I   |   jeremy.canfield@freekb.net   |