title: Why I receive tcp segment that shrink the window?
body: <p>I was capturing packets with Wireshark on my laptop and found a packet send by the server shrink its receive window. It's a connection from my ubuntu18.04 to "connectivity-check.ubuntu.com".</p>
  
  <p>I read rfc793 and TCPIP Illustrated volumn1, both say "is strongly discouraged to shrink the window". </p>
  
  <p>Here is Wireshark's output. I disable HTTP dissection in Wireshark to prevent distraction. </p>
  
  <pre><code>   4198 0.026547255    2019-04-03 12:27:48.870761715 192.168.3.141         35.222.85.5           TCP      74     53846 → 80 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=3960112411 TSecr=0 WS=128
     4199 0.281380222    2019-04-03 12:27:49.152141937 35.222.85.5           192.168.3.141         TCP      74     80 → 53846 [SYN, ACK] Seq=0 Ack=1 Win=28160 Len=0 MSS=1412 SACK_PERM=1 TSval=2281826280 TSecr=3960112411 WS=128
     4200 0.000092140    2019-04-03 12:27:49.152234077 192.168.3.141         35.222.85.5           TCP      66     53846 → 80 [ACK] Seq=1 Ack=1 Win=29312 Len=0 TSval=3960112693 TSecr=2281826280
     4201 0.000191823    2019-04-03 12:27:49.152425900 192.168.3.141         35.222.85.5           TCP      153    53846 → 80 [PSH, ACK] Seq=1 Ack=1 Win=29312 Len=87 TSval=3960112693 TSecr=2281826280
     4202 0.306769219    2019-04-03 12:27:49.459195119 35.222.85.5           192.168.3.141         TCP      66     80 → 53846 [ACK] Seq=1 Ack=88 Win=26112 Len=0 TSval=2281826585 TSecr=3960112693
     4203 0.000076022    2019-04-03 12:27:49.459271141 35.222.85.5           192.168.3.141         TCP      214    80 → 53846 [PSH, ACK] Seq=1 Ack=88 Win=26112 Len=148 TSval=2281826586 TSecr=3960112693
     4204 0.000028644    2019-04-03 12:27:49.459299785 192.168.3.141         35.222.85.5           TCP      66     53846 → 80 [ACK] Seq=88 Ack=149 Win=30336 Len=0 TSval=3960113000 TSecr=2281826586
     4205 0.000045328    2019-04-03 12:27:49.459345113 35.222.85.5           192.168.3.141         TCP      66     80 → 53846 [FIN, ACK] Seq=149 Ack=88 Win=26112 Len=0 TSval=2281826586 TSecr=3960112693
     4206 0.000183562    2019-04-03 12:27:49.459528675 192.168.3.141         35.222.85.5           TCP      66     53846 → 80 [FIN, ACK] Seq=88 Ack=150 Win=30336 Len=0 TSval=3960113000 TSecr=2281826586
     4207 0.245163856    2019-04-03 12:27:49.704692531 35.222.85.5           192.168.3.141         TCP      66     80 → 53846 [ACK] Seq=150 Ack=89 Win=26112 Len=0 TSval=2281826890 TSecr=3960113000
  </code></pre>
  
  <p>As the captured result shows, frame 4199 from server advertise a window sized 28160, but after receiving 87 bytes of data in 4201, the window shrinks to 26112 in 4202 which exactly equals to 2048(is that because server just swaps out a memory page?)</p>
  
  <p>I want to know what can be the reasons for the server to shrink its TCP receive window? It's highly discouraged by RFC, I thought this kind of behavior wouldn't be implemented in TCPIP stack within an OS.</p>