topic Re: TCP Flag - Push in Network Security

TCP Flag - Push

manuadoor — Mon, 11 Mar 2019 18:00:36 GMT

Small doubt Reg. TCP Flag, "PUSH". I was thought that this flag is set only to the last packet of a segmant, to tell the receving end to "PUSH" the data to the application, so that the cached data will be moved.

But recently I read that

" This particular flag is used quite frequently at the beginning and end of a data transfer, affecting the way the data is handled at both ends."

Why it is required in the begining.. what is the use,,, ??

Re: TCP Flag - Push

David White — Thu, 17 Jun 2010 14:10:29 GMT

RFC 793 (TCP) defines the use of the Push flag. See section 2.8:

2.8.  Data Communication

  The data that flows on a connection may be thought of as a stream of
  octets.  The sending user indicates in each SEND call whether the data
  in that call (and any preceeding calls) should be immediately pushed
  through to the receiving user by the setting of the PUSH flag.

  A sending TCP is allowed to collect data from the sending user and to
  send that data in segments at its own convenience, until the push
  function is signaled, then it must send all unsent data.  When a
  receiving TCP sees the PUSH flag, it must not wait for more data from
  the sending TCP before passing the data to the receiving process.

  There is no necessary relationship between push functions and segment
  boundaries.  The data in any particular segment may be the result of a
  single SEND call, in whole or part, or of multiple SEND calls.

  The purpose of push function and the PUSH flag is to push data through
  from the sending user to the receiving user.  It does not provide a
  record service.

  There is a coupling between the push function and the use of buffers
  of data that cross the TCP/user interface.  Each time a PUSH flag is
  associated with data placed into the receiving user's buffer, the
  buffer is returned to the user for processing even if the buffer is
  not filled.  If data arrives that fills the user's buffer before a
  PUSH is seen, the data is passed to the user in buffer size units.

  TCP also provides a means to communicate to the receiver of data that
  at some point further along in the data stream than the receiver is
  currently reading there is urgent data.  TCP does not attempt to
  define what the user specifically does upon being notified of pending
  urgent data, but the general notion is that the receiving process will
  take action to process the urgent data quickly.

In practice, many TCP senders use the Push flag to indicate the segment of data they have sent needs to be delivered to the receiver before awaiting additional data. A common example of an application using the Push flag frequently is telnet. When you use telent, what you type is generally sent character-by-character. Each character should be delivered to the receiver without being queued up. Therefore, for every character you type, if you look at the packet dump, you will notice the Push flag will be set.

Hope that helps answer your question. If so, let us know by marking the question as answered. And, if not, please ask clarifying questions.

Sincerely,

David.

Re: TCP Flag - Push

manuadoor — Thu, 17 Jun 2010 14:17:51 GMT

Yea.. I got it, another example would be realplayer streaming, but my doubt is that for normal traffic whether it will be set when the datatrasfer starts.

ofcoz it must be send when finished to educate the receiver, "Finished, now you push to application from cache".

I do understand that for telnet all the packet will be marked with push, so that it will immediately reflect in receivers application layer. One thing is that their will be send cache and receive cache,Anything related to send cache while push is set??

Re: TCP Flag - Push

David White — Thu, 17 Jun 2010 14:23:44 GMT

I'm not sure I am following your follow-up question. There is nothing to prevent the sender from setting the Push flag in the beginning of a transmission. It is entirely up to the sender when it wants to set it.

What is your definition of "normal traffic"? And what is the root problem we are trying to solve?

Re: TCP Flag - Push

manuadoor — Thu, 17 Jun 2010 14:38:54 GMT

By "Normal Traffic" I meant the traffic which need not to set push flag (type of traffic where in cache wont be a problem, eg: ftp)

All I did is recently I tried to update my KB and read http://www.firewall.cx/tcp-analysis-section-4.php It says "This particular flag is used quite frequently at the beginning and end of a data transfer, affecting the way the data is handled at both ends."

So I wonder why it is to be set in the begining of a traffic?? ofcoz in telnet /real player all the packet will be set by "push". And for ftp and all push to be sent at the end of each segmant so that it will get transfered from the cache of receiving end to the ftp application!!

Re: TCP Flag - Push

David White — Thu, 17 Jun 2010 14:53:27 GMT

I don't think we can speak for the author of another article. What I can say is that for TCP, once a connection is established, the

initiator requests something (for HTTP it would typically be a GET for a web page) When that request is sent, the Push flag is usually set - and that is at the start/beginning of the TCP session.

Sincerely,

David.

Re: TCP Flag - Push

manuadoor — Thu, 17 Jun 2010 15:08:13 GMT

Yea.. The documet clearly says that for http and other traffic thru prosies will be set wil push to get necessary priorities, but am not clear 😞