I encountered a strange problem earlier when I tried to visit a website: the TCP connection would just hang. I ran Wireshark to see what was happening and noticed a pair of strange acks that made no sense to me.
I tried to access the same website from two other machines, and ran tcpdump to capture the traffic. Both the other machines were able to complete the request.
I loaded the tcpdump output into Wireshark to compare with the failing connection. The only significant difference was the TCP window size. The failing connection had a window size of 5888, while both working connections had window sizes of 5840. But it wasn’t quite that simple. The failing connectian and one of the working connections were using window scaling, so I had the following three situations:
| working? | TCP win | scale | window size |
|---|---|---|---|
| no | 0x002e | 7 | 5888 |
| yes | 0x05b4 | 2 | 5840 |
| yes | 0x16d0 | 0 | 5840 |
sysctl net/ipv4/tcpwindowscaling=0 and I could access the website!
Now that I know what the problem is I am happy to switch window scaling back on and not visit that website until they fix their buggy router or firewall.