Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to distinguish between ack packet as a response to syn-ack to ack packet during the connection (and not during handshake)? Someone told me that not all OS marked tcp packet during connection as push-ack and some OS (or tools) marked ack packet during connection without mark the push too.

Is it legal ? does OS tolerance to this? (to ack packet without push after handshake already done)?

Ps. i dont save packet history, so i have an ack packet and need to figure out what kind of ack it is.

Thank you

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

No, that's not the right approach, and you certainly won't see consistent behavior on that. See here for a good overview of what the PSH flag is for.

If you need to distinguish between ACKing a SYN/ACK, and ACKing data, you should instead examine the TCP sequence numbers.

share|improve this answer
    
How the sequence will help me to distinguish ? How it will help to figure out if this is ACKing data or ACKing a SYN/ACK? –  user1495181 Aug 8 '12 at 15:39
2  
@user1495181 The ACK flag's number will be one greater than the sequence number of the SYN/ACK packet. –  Shane Madden Aug 8 '12 at 15:43
    
I dont save packet history. I got packet and need to know which ack it is. –  user1495181 Aug 8 '12 at 15:44
1  
The 3-way handshake is where the initial sequence numbers for the session are established - and these numbers are generally supposed to be as random as possible. The only unique thing about the third packet (ACK sent in response to SYN-ACK) is that its sequence number is the value from the SYN-ACK + 1. To correctly analyze the handshake process (or to differentiate the first ACK) you need at least the initial SYN packet. –  rnxrx Aug 8 '12 at 16:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.