Hi Jasper,
First of all, tcpdump cannot be leveraged to monitor congestion window (CWND) sizes because CWND is not a field in TCP packets. It is just a notion / variable (optionally) maintained by congestion control algorithms.
For those congestion control schemes that are available in Linux kernel (Cubic, BBR, Vegas, etc.), you have a few options to access CWND:
1) If your program is able to manipulate the TCP socket, you could use a socket option called "TCP_INFO" to retrieve CWND from kernel. Please refer to our example
here.
2) If option 1) is not feasible, e.g., when you are running iperf or other third-party programs that own the underlying TCP socket, you would have to find out if these third-party programs expose such information by themselves, or you would have to resort to other kernel tools. The kernel module "
tcp_probe" used to be a choice but I did not use it before for this purpose. In the latest Linux distributions, tcp_probe seems to have been removed, making this task even trickier.
For other congestion control schemes that are homemade (Copa, Indigo, Sprout, etc.), there is no unified way to access CWND. They may even choose to not have the notion of CWND.
Regarding your last question, the usage of tcpdump to monitor emulated links is exactly the same as normal usage. For example, if you create a Mahimahi shell like mm-delay, then a virtual interface "ingress" will be created inside the shell. You may simply run "tcpdump -i ingress" inside it to capture packets, and to capture packets coming out of that interface, you just need to run something like "tcpdump -i delay-XXXXXX". Hope this is helpful!
Best,
Francis