On Tue, Aug 07, 2001 at 10:56:46AM +1200, Mike Sutton [ awacs ] wrote: Is 17520 a common value ? Depends Does the OS set this or the program ? Depends. The OS sets this, because the OS constructs the packets, but to what value the OS sets this to is decided by the machanics of the underlying TCP implementation _AND_ also the application. For all the the simpest cases, this interaction is far from straightforward. In a simple case, the OS will alloc n-bytes for receiving to a tcp session (ignore sending for now), it will advertise this as the window... if the application doesn't read data, ACKs will contain smaller and smaller window sizes until it hits zero. Now, the OS might now advertise all of the memory it has reserved, and the application can fiddle this, and there are other things like window-scaling which mean the value your looking at might not really represent anything meaningful at the application layer. That fact theat worm packets have this value has nothing to do with the worm perse (probably not, I don't think it frobs the send/recv buffers), but more to do with the TCP implementation used. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog