Message-Id: <200210221257.IAA00400@guns.lerc.nasa.gov> From: Mark Allman <mallman@grc.nasa.gov> Subject: Re: tcptrace initial window parameter Date: Tue, 22 Oct 2002 08:57:56 -0400
> I have finally arrived at the conclusion that the initial window
> parameter in the output of tcptrace is not the real Initial Window
> used by TCP, but only an estimation of that.
Yes!
My own opinion is that anything tcptrace (or any tool for that
matter) reports that is not directly from the stored packet trace
(e.g., something like the IP address that comes directly from the
bits that crossed the wire you were watching) is an estimate. And,
estimates should be taken with a grain of salt. Some estimators are
better than others. Some are very good. Some stink. Many of them
(e.g., the initial window size in tcptrace) will give different
answers based on the vantage point of the trace in question. So, I
think you need to fully understand the estimator being applied
before blindly using the numbers some tool spits at you.
(And, in that spirit I know the tcptrace team is currently putting
together a document that outlines what all the output from tcptrace
actually means. A Good Thing in my mind.)
allman
-- Mark Allman -- BBN/NASA GRC -- http://roland.grc.nasa.gov/~mallman/---------------------------------------------------------------------------- To unsubscribe, send a message with body containing "unsubscribe tcptrace" to majordomo@tcptrace.org.
This archive was generated by hypermail 2b30 : 10/22/02 EDT