Meaning of packet flags in netfmt output

[Dave Burton_5]

I run a nettl command followed by a netfmt. Excerpt from the netfmt output:

IP 164.39.241.5.49194 > 164.39.9.182.10128: [DF] A bacd03c9:bacd097d(5b4) ack: 8f82a14f win: 8000 bgssd
IP 164.39.241.5.49194 > 164.39.9.182.10128: [DF] PA bacd097d:bacd0f31(5b4) ack: 8f82a14f win: 8000 bgssd

What's the difference between the ACK packet in line 1 and the PUSH ACK packet in line 2? Are there any other packet types?

[G. Vrijhoeven · Accepted solution]

Hi,

The push flag stands for:

PUSH flag
â Sender TCP should send all data without waiting when
its application specifies PUSH operation
â Improves response time for interactive applications


check:http://www.cs.utsa.edu/faculty/boppana/courses/04spr487/04s4873lec14tcp.pdf

For more info.

Regards,

G

[Dave Burton_5]

Gideon,

Thanks for the doc. The TCP state transition stuff was useful to me also.

Follow-up question. Under what circumstances does an application decide that it's OK to send data using PUSH. My netfmt showed the application switching between A packets and PA packets constantly.

Cheers
Dave

[marie-noelle jeanson_1]

Dave,

If you take a look at the RFC793 (for TCP), under 2.8 Data Communication, it says:

The sending user indicates in each SEND call whether the data in that call (and any preceeding calls) should be immediately pushed through to the receiving user by the setting of the PUSH flag.

A sending TCP is allowed to collect data from the sending user and to send that data in segments at its own convenience, until the push function is signaled, then it must send all unsent data. When a receiving TCP sees the PUSH flag, it must not wait for more data from the sending TCP before passing the data to the receiving process.
The purpose of push function and the PUSH flag is to push data through from the sending user to the receiving user. It does not provide a record service.

There is a coupling between the push function and the use of buffers of data that cross the TCP/user interface. Each time a PUSH flag is associated with data placed into the receiving user's buffer, the buffer is returned to the user for processing even if the buffer is not filled. If data arrives that fills the user's buffer before a PUSH is seen, the data is passed to the user in buffer size units.

For more details, read:
http://www.faqs.org/rfcs/rfc793.html

Regards,

Marie-Noelle

[rick jones]

Keep in mind that PSH is _completely_ advisory. In particular, not all stacks will set PSH at the end of a send(), and you should _NEVER_ ass-u-me that PSH will preserve application-level message boundaries