What is Window Scaling

Window scaling is a TCP option that allows receive windows larger than 64 KB — necessary for high-bandwidth, high-latency connections where 64 KB of in-flight data is nowhere near enough to fill the pipe.

What is the problem?

TCP's flow control uses a receive window to tell the sender how much data the receiver can accept. This window size is stored in a 16-bit field in the TCP header, giving a maximum value of 65,535 bytes (64 KB).

On a 1 Gbps link with 50ms round-trip latency, the bandwidth-delay product is 6.25 MB. That means 6.25 MB of data can be in flight at any time. With a 64 KB window, TCP can only use about 1% of the available bandwidth — the sender fills the window almost instantly, then sits idle waiting for ACKs.

How does window scaling work?

During the TCP handshake, both sides can include a window scale option — a value between 0 and 14 that specifies how many bits to left-shift the window field. A scale factor of 7 means the actual window is the header value multiplied by 128. A scale factor of 14 allows windows up to 1 GB.

The scale factor is negotiated once during the SYN exchange and cannot change for the lifetime of the connection. Both sides can choose different scale factors.

How do you see it?

In a tcpdump or Wireshark capture, window scaling appears in the SYN and SYN-ACK packets as a TCP option: wscale 7. After the handshake, the window values shown in subsequent packets must be multiplied by the scale factor to get the real window size.

Why it matters

Without window scaling, TCP cannot fully utilize any modern network link. It was introduced in 1992 (RFC 1323, updated in RFC 7323) and is enabled by default on every modern operating system. If you see poor throughput on a high-bandwidth connection, a missing or misconfigured window scale is one of the first things to check.