Wireshark · Wireshark-users: Re: [Wireshark-users] PSH/ACK in all packets

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 25, 2008, at 12:10 PM, Troy Tate wrote:

> I have an application where all packets seem to have the PSH/ACK  
> flags set (from both sides of the conversation). This is a barcode  
> application. Is this a typical behavior for these types of  
> applications? The user is reporting slow performance, but I am not  
> seeing any network issues other than these flags set in every packet.

It is typical behavior for the type of application called "TCP-based  
application" to have ACK set on all but some of the initial packets;  
to quote RFC 793:

	Acknowledgment Number: 32 bits
	If the ACK control bit is set this field contains the value of the  
next sequence number the sender of the segment is expecting to  
receive. Once a connection is established this is always sent.
Whether PSH is set depends on whether the TCP implementation sets it;  
that's probably not application-specific.  In Mac OS X, for example,  
there's nothing the application can do to explicitly request PSH;  
looking at the versions of the {Free,Net,Open}BSD TCP code I had  
handy, the same is true there.  I don't have the Linux or Solaris code  
handy so I don't know whether they can explicitly force a push, and I  
don't know what other UN*Xes or Windows do.