为什么我得到没有ZeroWindow的TCP窗口更新

Question

文档说TCP窗口更新通常是由于之前的零窗口。

我无法找到之前的零窗口。还有什么呢？

Transmission Control Protocol, Src Port: 5431, Dst Port: 703, Seq: 1, Ack: 38529, Len: 0
    Source Port: 5431
    Destination Port: 703
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgment number: 38529    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x010 (ACK)
    Window size value: 256
    [Calculated window size: 256]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x03c0 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]
        [TCP Analysis Flags]
            [Expert Info (Chat/Sequence): TCP window update]

Answer 1

如果Wireshark是一个ACK数据包，除了窗口大小以外没有其他任何更改，则将其标记为“ TCP窗口更新”。即使窗口远未满时，某些TCP堆栈也会发送此类数据包（这种情况会导致“零窗口”数据包）。

参考：https://osqa-ask.wireshark.org/questions/27253/under-what-conditions-wireshark-marks-a-packet-as-tcp-window-update-packet