[Bro] window_recision

Siwek, Jonathan Luke jsiwek at illinois.edu
Mon Dec 16 11:48:34 PST 2013

On Dec 16, 2013, at 12:11 PM, Thomas Mullins <TSMullins at mecc.edu> wrote:

> While searching our BRO logs, I came across a few hosts giving  window_recision errors.  A Google search did not shed any light on this subject.  What does window_recision mean?

I think it means that a TCP shrunk its recv-window by more than the amount of data its ACKing.  i.e. in https://tools.ietf.org/html/rfc793#section-3.7 :

  The mechanisms provided allow a TCP to advertise a large window and to
  subsequently advertise a much smaller window without having accepted
  that much data.  This, so called "shrinking the window," is strongly
  discouraged.  The robustness principle dictates that TCPs will not
  shrink the window themselves, but will be prepared for such behavior
  on the part of other TCPs.

- Jon

More information about the Bro mailing list