Siwek, Jonathan Luke
jsiwek at illinois.edu
Mon Dec 16 11:48:34 PST 2013
On Dec 16, 2013, at 12:11 PM, Thomas Mullins <TSMullins at mecc.edu> wrote:
> While searching our BRO logs, I came across a few hosts giving window_recision errors. A Google search did not shed any light on this subject. What does window_recision mean?
I think it means that a TCP shrunk its recv-window by more than the amount of data its ACKing. i.e. in https://tools.ietf.org/html/rfc793#section-3.7 :
The mechanisms provided allow a TCP to advertise a large window and to
subsequently advertise a much smaller window without having accepted
that much data. This, so called "shrinking the window," is strongly
discouraged. The robustness principle dictates that TCPs will not
shrink the window themselves, but will be prepared for such behavior
on the part of other TCPs.
More information about the Bro