Wireshark TCP – How to Calculate MSS When Window Scaling is Set

When the server's MSS is less than 1452, the router should not touch the MSS. The client will see the correct value sent by the server.

tcp.len and data.len will match if Wireshark does not interpret the data in the TCP stream. If wireshark can make sense of the data, it can update data.len. They don't have to match.

For example, in the case of HTTP, data.len can contain the total length of an HTTP POST request reassembled from which is spread over multiple TCP segments.

So all you need to do is: Right Click one of the TCP segments => Protocol Preferences => uncheck Relative Sequence Numbers.

FYI: Ignore the filters, I just did that to make it more aesthetically pleasing. They have nothing to do with the option selected.

EDIT

So to address your comment:

In the older version of Ethereal it has the option to disable relative sequence numbers and window scaling. When the window scaling option is enabled in the older version you first mentioned (Ethereal aka old school Wireshark), it simply calculates the current window size against the current window scaling factor to give you a total. When it's disabled, it only displays the current window size without the scaling factor taken into account.

The picture above is a snippet from the new version of Wireshark sniffing a TCP segment. Here's how it correlates to the older version.

Window Size value This is the value present when window scaling is disabled in the older version. Calculated Window size This is the value present when window scaling is enabled in the older version.

The major difference being is that the newer version contains both values and not just one or the other, so disabling the window scaling option isn't necessary.