How to enable/disable TCP window scale n’ change scale factor

[root@centos5-1 ~]# uname -r 2.6.18-238.5.1.el5 [root@centos5-1 ~]# cat /etc/redhat-release CentOS release 5.6 (Final)

On CentOS5 window scale is enabled by default.

[root@centos5-1 ~]# cat /proc/sys/net/ipv4/tcp_window_scaling 1

[ How to disable window scale ]

1 means window scale is enabled.
You can disable window scale by setting tcp_window_scaling to 0

[root@centos5-1 ~]# echo 0 > /proc/sys/net/ipv4/tcp_window_scaling

[ How to change scale factor ]

receive buffer per one socket

[root@centos5-1 ~]# cat /proc/sys/net/ipv4/tcp_rmem 4096 87380 1048576

87380 will be overwritten by a value of /proc/sys/net/core/rmem_default

[root@centos5-1 ~]# cat /proc/sys/net/core/rmem_default 129024

1048576 will be overwritten by a value of /proc/sys/net/core/rmem_max

[root@centos5-1 ~]# cat /proc/sys/net/core/rmem_max 129024

Scale factor is 5 when TCP parameters are above values.

[root@centos5-1 ~]# tshark -r aa.pcap | head -1 Running as user "root" and group "root". This could be dangerous.  1   0.000000 192.168.11.140 -> 74.125.91.104 TCP 47405 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=1048663 TSER=0 WS=5

so this machine’s window size is multiplied by 2**5 :

[root@centos5-1 ~]# tshark -n -r aa.pcap ip.src==192.168.11.140 and tcp.port==57152 -V | egrep -i "window size" Running as user "root" and group "root". This could be dangerous.    Window size: 5840    Window size: 5856 (scaled)    <- 5856*2**5 = 187392    Window size: 5856 (scaled)    Window size: 8736 (scaled)    <- 8736*2**5 = 279552    Window size: 11648 (scaled)    Window size: 14528 (scaled)    Window size: 17344 (scaled)    Window size: 20256 (scaled)    Window size: 23136 (scaled)    Window size: 26048 (scaled)    Window size: 28928 (scaled)  <- 28928*2**5 = 925696

when window scale is disabled

[root@centos5-1 ~]# tshark -n -r bb.pcap ip.src==192.168.11.140 and tcp.port==50526 -V | egrep -i "window size" Running as user "root" and group "root". This could be dangerous.    Window size: 5840    Window size: 5840    Window size: 5840    Window size: 8412    Window size: 8412    Window size: 11216    Window size: 14020    Window size: 16824    Window size: 19628    Window size: 22432    Window size: 25236    Window size: 28040

You can change scale factor by editing the value of rmem_default , rmem_max n’ tcp_rmem.

set scale factor to 0

[root@centos5-1 ~]# echo "4096 65535 65535" > /proc/sys/net/ipv4/tcp_rmem [root@centos5-1 ~]# echo 65535 > /proc/sys/net/core/rmem_default [root@centos5-1 ~]# echo 65535 > /proc/sys/net/core/rmem_max

[root@centos5-1 ~]# tshark -n -r zz.pcap | head -1 Running as user "root" and group "root". This could be dangerous.  1   0.000000 192.168.11.140 -> 72.14.203.104 TCP 48507 > 80 [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=2227822 TSER=0 WS=0

[root@centos5-1 ~]# tshark -n -r zz.pcap ip.src==192.168.11.140 and tcp.port==41430 -V | egrep -i "window size" Running as user "root" and group "root". This could be dangerous.    Window size: 5840  <- 5840*2**0 = 5840    Window size: 5840    Window size: 5840    Window size: 8412    Window size: 8412    Window size: 11216    Window size: 14020    Window size: 16824    Window size: 19628    Window size: 22432    Window size: 25236    Window size: 25236

Window size: 5840    Checksum: 0x5df4 [correct]        [Good Checksum: True]        [Bad Checksum: False]    Options: (20 bytes)        Maximum segment size: 1460 bytes        SACK permitted        Timestamps: TSval 2227960, TSecr 0        NOP        Window scale: 0 (multiply by 1)

set scale factor to 1 ( 65535*2**1 = 131070 )

[root@centos5-1 ~]# echo 131070 > /proc/sys/net/core/rmem_default [root@centos5-1 ~]# echo 131070 > /proc/sys/net/core/rmem_max [root@centos5-1 ~]# echo "4096 131070 131070" > /proc/sys/net/ipv4/tcp_rmem

[root@centos5-1 ~]# tshark -n -r cc.pcap ip.src==192.168.11.140 and tcp.port==57780 | head -1 Running as user "root" and group "root". This could be dangerous. 18   0.144861 192.168.11.140 -> 64.233.183.104 TCP 57780 > 80 [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=2760408 TSER=0 WS=1

[root@centos5-1 ~]# tshark -n -r cc.pcap ip.src==192.168.11.140 and tcp.port==57780 -V | egrep -i scale Running as user "root" and group "root". This could be dangerous.        Window scale: 1 (multiply by 2)    Window size: 5840 (scaled)    Window size: 5840 (scaled)    Window size: 8736 (scaled)    Window size: 11632 (scaled)    Window size: 14528 (scaled)    Window size: 17332 (scaled)    Window size: 20228 (scaled)    Window size: 23124 (scaled)    Window size: 26020 (scaled)    Window size: 28916 (scaled) <- 28916*2**1

set scale factor to 8 ( 65535*2**8= 16776960 )

[root@centos5-1 ~]# echo "4096 16776960 16776960" > /proc/sys/net/ipv4/tcp_rmem   [root@centos5-1 ~]# echo 16776960 > /proc/sys/net/core/rmem_default [root@centos5-1 ~]# echo 16776960 > /proc/sys/net/core/rmem_max

[root@centos5-1 ~]# tshark -r dd.pcap ip.src==192.168.11.140 | egrep -i syn Running as user "root" and group "root". This could be dangerous.  3   1.391173 192.168.11.140 -> 74.125.95.104 TCP 51852 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=3291341 TSER=0 WS=8

[root@centos5-1 ~]# tshark -r dd.pcap ip.src==192.168.11.140 and tcp.port==40520 -V | egrep -i scale Running as user "root" and group "root". This could be dangerous.        Window scale: 8 (multiply by 256)    Window size: 5888 (scaled)  <- 5888*2**8 = 1507328    Window size: 5888 (scaled)    Window size: 8960 (scaled)    Window size: 11776 (scaled)    Window size: 14592 (scaled)    Window size: 17408 (scaled)    Window size: 20480 (scaled)    Window size: 23296 (scaled)    Window size: 26112 (scaled)    Window size: 28928 (scaled)

Thx for reading :)