0

Is there a way to distinguish between ack packet as a response to syn-ack to ack packet during the connection (and not during handshake)? Someone told me that not all OS marked tcp packet during connection as push-ack and some OS (or tools) marked ack packet during connection without mark the push too.

Is it legal ? does OS tolerance to this? (to ack packet without push after handshake already done)?

Ps. i dont save packet history, so i have an ack packet and need to figure out what kind of ack it is.

Thank you

1 Answer 1

3

No, that's not the right approach, and you certainly won't see consistent behavior on that. See here for a good overview of what the PSH flag is for.

If you need to distinguish between ACKing a SYN/ACK, and ACKing data, you should instead examine the TCP sequence numbers.

4
  • How the sequence will help me to distinguish ? How it will help to figure out if this is ACKing data or ACKing a SYN/ACK? Aug 8, 2012 at 15:39
  • 2
    @user1495181 The ACK flag's number will be one greater than the sequence number of the SYN/ACK packet. Aug 8, 2012 at 15:43
  • I dont save packet history. I got packet and need to know which ack it is. Aug 8, 2012 at 15:44
  • 1
    The 3-way handshake is where the initial sequence numbers for the session are established - and these numbers are generally supposed to be as random as possible. The only unique thing about the third packet (ACK sent in response to SYN-ACK) is that its sequence number is the value from the SYN-ACK + 1. To correctly analyze the handshake process (or to differentiate the first ACK) you need at least the initial SYN packet.
    – rnxrx
    Aug 8, 2012 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .