TCP initial window size is 5840?

If you open an html with Firefox on Linux, the tcpdump might show SYN packet with "Win=5840". Does it mean TCP initial advertised window size is 5840?

 

No. In fact, there is another field in TCP option, "window scale=6". So the real initial is 5840 * 2^6 = 373760.

 

This feature is defined RFC1323, called "window scale".

 

Linux calculate this value in a rather complicated way. For detail, you could refer "tcp_select_initial_window()" in net/ipv4/tcp_output.c