First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

When I use the "bytes sent since last PSH flag"?

  • retag add tags

Hi,

Please explain to me how can I use the "bytes sent since last PSH flag" in TCP [SEQ/ACK analysis] info.

As far as I know, We can refer to the "Bytes in flight" filed to get the picture for the Congestion window.

I found in my trace that the "bytes sent since last PSH flag" field value and "bytes in flight" field one show different values.

Please explain to me what is the case those two filed show different values.

Thank you in advance. Yves

yves's avatar
1
yves
asked 2021-07-16 03:20:41 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

2 Answers

0

When the sender wants the receiver to send all its data in its buffer to the application, it will send a TCP PUSH. There are usually two reasons for this: the TCP CWND is full or it is time sensitive application. It is expected that the receiver will respond with an updated ACK. If there is no response, there could be a problem. The exception if it is a FIN or RESET. The bytes in flight, are bytes that Wireshark hasn't seen an ACK for. It's important to know the location of the sniffer because it affects when Wireshark sees the response to the TCP PUSH.

BigFatCat's avatar
31
BigFatCat
answered 2021-07-16 13:17:35 +0000
edit flag offensive 0 remove flag delete link

Comments

Can you explain to me in more detail about the meaning of " It's important to know the location of the sniffer because it affects when Wireshark sees the response to the TCP PUSH."?

yves's avatar yves (2021-07-19 05:20:28 +0000) edit
add a comment see more comments
0

They are two different things that aren't related, hence the different sizes.

Bytes in flight is the number of bytes transmitted since the last ACK received.

Bytes since the last PSH flag is the number of transmitted since the last segment with the PSH flag set was transmitted. Some info on how the PSH flag is handled by both sender and receiver can be found here.

grahamb's avatar
23.8k
grahamb
answered 2021-07-16 08:04:34 +0000, updated 2021-07-16 13:36:15 +0000
edit flag offensive 0 remove flag delete link

Comments

Thank you for your input

yves's avatar yves (2021-07-19 05:20:41 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer