How can you identify TCP slow-start behavior in a capture?

• A. Observe the initial rapid growth of the congestion window and small initial window, followed by a ramp-up; analyze cwnd changes via tcp.window_size_value over the initial RTTs.
• B. It indicates network congestion is zero.
• C. It indicates DNS failures.
• D. It shows HTTP transfer encoding.

Answer: (A)

The pattern you’re looking for is the early, rapid expansion of the sending window as TCP probes the network, starting from a small initial window and growing quickly each RTT. This is what slow-start looks like in a capture: data points show the congestion window increasing rapidly from its initial value, often roughly doubling with each round-trip until it reaches a threshold and slows to linear growth.

In a capture, you identify this by tracking how the congestion window changes over the first RTTs. If you can view cwnd values over time (for example, using the tcp.window_size_value field or the TCP congestion window graph in your tool), you’ll see an initial small window followed by a swift, exponential rise in cwnd as ACKs arrive. This is the hallmark of slow-start.

The other options don’t depict this behavior at all. They point to unrelated issues like DNS problems, HTTP encoding, or a notion of zero congestion that doesn’t reflect how TCP ramps up its transmission rate during connection start.