TCP - Window Size Scaling
When TCP was originally designed, the performance of networks was relatively limited. For this reason, the window size field in the TCP header was designed with a size of 16 bits, which was considered more than enough. This gives a maximum window size of 65536 bytes. However, today's modern networks are capable of establishing sessions with much larger window sizes, so a way to achieve larger window sizes was needed.
Instead of changing the size of the field, a Window Scaling option was added. This exists within the TCP options that can be appended to the end of the TCP header. This option is called the TCP Window Scale Option (WSopt). It has a length of 3 bytes and has the following format:
+---------+---------+---------+ | Kind=3 |Length=3 |shift.cnt| +---------+---------+---------+ 1 1 1
This is further described in RFC 7323 linked below. As stated in the RFC:
The window scale extension expands the definition of the TCP window to 30 bits and then uses an implicit scale factor to carry this 30-bit value in the 16-bit window field of the TCP header. The exponent of the scale factor is carried in a TCP option, Window Scale. This option is sent only in asegment (a segment with the SYN bit on), hence the window scale is fixed in each direction when a connection is opened.
Put simply, this option introduces a scaling factor that can be used to multiple the value found in the window size field to get a larger value. The maximum value of the window size becomes 2^30 = 1,073,741,824 bytes.
The following Wireshark packet capture shows the details of the window size and the scaling factor found in the TCP options.
In the above example, the window size value found in the window field is 2070 and the scaling factor found in the TCP options is 64. The resulting window size is 2070 * 64 = 132480.
Links:
https://forum.networklessons.com/t/tcp-window-size-scaling/1276/98?u=lagapidis
https://networklessons.com/cisco/ccnp-route/tcp-window-size-scaling