It turns out that the value for tcp_mss is not trustworthy
Instead of doing this:
" “tcp_mss”: , (tstat ‘c_mss/s_mss’, field 64,87)"
the real value on the wire is the minimum of the 2 values (field 64 and 87)
So instead of reporting just the value in 64 or 87 (depending on the direction of the flow) we need to report the minimum of the 2 values, regardless of the direction.
montegoode
commented
7 years ago
It turns out that the value for tcp_mss is not trustworthy
Instead of doing this: " “tcp_mss”:, (tstat ‘c_mss/s_mss’, field 64,87)"
the real value on the wire is the minimum of the 2 values (field 64 and 87)
So instead of reporting just the value in 64 or 87 (depending on the direction of the flow) we need to report the minimum of the 2 values, regardless of the direction.