ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] PSH/ACK in all packets

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 25 Jul 2008 14:38:08 -0700
(Mail.app and WebKit strike again; there's a blank line missing between paragraphs. Hopefully this puts the blank line back.)

On Jul 25, 2008, at 12:10 PM, Troy Tate wrote:

I have an application where all packets seem to have the PSH/ACK
flags set (from both sides of the conversation). This is a barcode
application. Is this a typical behavior for these types of
applications? The user is reporting slow performance, but I am not
seeing any network issues other than these flags set in every packet.

It is typical behavior for the type of application called "TCP-based
application" to have ACK set on all but some of the initial packets;
to quote RFC 793:

	Acknowledgment Number: 32 bits
	If the ACK control bit is set this field contains the value of the
next sequence number the sender of the segment is expecting to
receive. Once a connection is established this is always sent.

Whether PSH is set depends on whether the TCP implementation sets it;
that's probably not application-specific.  In Mac OS X, for example,
there's nothing the application can do to explicitly request PSH;
looking at the versions of the {Free,Net,Open}BSD TCP code I had
handy, the same is true there.  I don't have the Linux or Solaris code
handy so I don't know whether they can explicitly force a push, and I
don't know what other UN*Xes or Windows do.