Welcome!

Web Performance is a Journey, Not a Destination

Mehdi Daoudi

Subscribe to Mehdi Daoudi: eMailAlertsEmail Alerts
Get Mehdi Daoudi via: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


Blog Feed Post

TCP Flags and What They Mean

So you’re reviewing a packet capture and you come across the TCP headers with the URG or PSH flags set.  Have you ever wondered what they mean? Or what they do? Or what they’re supposed to do? Let’s dive in and check them out.

Pushing the data forward

Consider this scenario: you’re using one of your favorite browsers to download some html from a website. The actual request is pretty small and will likely not fill the entire segment, let alone two segments in order to be queued for dispatch. Instead, the request is packaged and marked with a PSH flag thereby informing the client’s operating system to move this request along to the server and not wait for the buffers to fill.

TCPflags1

 

We also learn from section 20.5 in TCP/IP Illustrated that the PSH flag is not something that is usually set by an API, but rather determined by the TCP implementation of the particular distribution. Accordingly, Berkley-derived operating systems use the PSH flag to signal that the send buffers are empty on the client side. This is evident in the response to the request above and captured below.

TCPflags2

 

It’s a small reply, which, too, does not fill a segment. Accordingly, it’s marked with a PSH before the transaction is concluded with the FIN.

My request is URGent!

The intended purpose of the URG flag is to let the stream and receiving application know that there is some data that needs to be prioritized. For example, you have a file transfer that needs to be aborted due to the fact that you inadvertently sent the wrong one.

The idea was that the URG flag would be set, with a pointer to the last byte of urgent data (set in the urgent pointer field of the TCP header) and prioritizes that data; the rest of the data in the segment is treated as normal priority data. Typically, the PSH flag is also set because the data being sent, is urgent, and shouldn’t wait around for the segment to be full before entering a queue for dispatch.

Per Stevens, (Section 20.8) there are differing implementations of the URG flag and a bifurcation as to urgent data and out-of-band management. To that end, finding a compliant packet trace has been elusive.

 

Fastly OpsCast ad

The post TCP Flags and What They Mean appeared first on Catchpoint's Blog.

Read the original blog entry...

More Stories By Mehdi Daoudi

Catchpoint radically transforms the way businesses manage, monitor, and test the performance of online applications. Truly understand and improve user experience with clear visibility into complex, distributed online systems.

Founded in 2008 by four DoubleClick / Google executives with a passion for speed, reliability and overall better online experiences, Catchpoint has now become the most innovative provider of web performance testing and monitoring solutions. We are a team with expertise in designing, building, operating, scaling and monitoring highly transactional Internet services used by thousands of companies and impacting the experience of millions of users. Catchpoint is funded by top-tier venture capital firm, Battery Ventures, which has invested in category leaders such as Akamai, Omniture (Adobe Systems), Optimizely, Tealium, BazaarVoice, Marketo and many more.