Wireshark-users: Re: [Wireshark-users] PSH/ACK in all packets

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 25 Jul 2008 14:26:44 -0700

On Jul 25, 2008, at 12:10 PM, Troy Tate wrote:

I have an application where all packets seem to have the PSH/ACK flags set (from both sides of the conversation). This is a barcode application. Is this a typical behavior for these types of applications? The user is reporting slow performance, but I am not seeing any network issues other than these flags set in every packet.

It is typical behavior for the type of application called "TCP-based application" to have ACK set on all but some of the initial packets; to quote RFC 793:

	Acknowledgment Number: 32 bits
If the ACK control bit is set this field contains the value of the next sequence number the sender of the segment is expecting to receive. Once a connection is established this is always sent. Whether PSH is set depends on whether the TCP implementation sets it; that's probably not application-specific. In Mac OS X, for example, there's nothing the application can do to explicitly request PSH; looking at the versions of the {Free,Net,Open}BSD TCP code I had handy, the same is true there. I don't have the Linux or Solaris code handy so I don't know whether they can explicitly force a push, and I don't know what other UN*Xes or Windows do.