Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to distinguish between ack packet as a response to syn-ack to ack packet during the connection (and not during handshake)? Someone told me that not all OS marked tcp packet during connection as push-ack and some OS (or tools) marked ack packet during connection without mark the push too.

Is it legal ? does OS tolerance to this? (to ack packet without push after handshake already done)?

Ps. i dont save packet history, so i have an ack packet and need to figure out what kind of ack it is.

Thank you

share|improve this question
up vote 3 down vote accepted

No, that's not the right approach, and you certainly won't see consistent behavior on that. See here for a good overview of what the PSH flag is for.

If you need to distinguish between ACKing a SYN/ACK, and ACKing data, you should instead examine the TCP sequence numbers.

share|improve this answer
How the sequence will help me to distinguish ? How it will help to figure out if this is ACKing data or ACKing a SYN/ACK? – Avihai Marchiano Aug 8 '12 at 15:39
@user1495181 The ACK flag's number will be one greater than the sequence number of the SYN/ACK packet. – Shane Madden Aug 8 '12 at 15:43
I dont save packet history. I got packet and need to know which ack it is. – Avihai Marchiano Aug 8 '12 at 15:44
The 3-way handshake is where the initial sequence numbers for the session are established - and these numbers are generally supposed to be as random as possible. The only unique thing about the third packet (ACK sent in response to SYN-ACK) is that its sequence number is the value from the SYN-ACK + 1. To correctly analyze the handshake process (or to differentiate the first ACK) you need at least the initial SYN packet. – rnxrx Aug 8 '12 at 16:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.