Is there a way to distinguish between ack packet as a response to syn-ack to ack packet during the connection (and not during handshake)? Someone told me that not all OS marked tcp packet during connection as push-ack and some OS (or tools) marked ack packet during connection without mark the push too.
Is it legal ? does OS tolerance to this? (to ack packet without push after handshake already done)?
Ps. i dont save packet history, so i have an ack packet and need to figure out what kind of ack it is.