08-13-2018 01:58 PM - edited 03-12-2019 05:29 AM
When running a capture & viewing output directly on shell, after a tcp handshake is made I always see pushes of data & sometimes resets e.g P (push) and R (reset). Are these cisco proprietary terms? Push & Reset? I ask because when I am looking at an actual pcap capture on wireshark (lets say I capture an SSH session to a server on a DMZ), I don't see these terms used on pcaps. I only notice them on thw ASA shell captures. Are these cisco proprietary terms?
Solved! Go to Solution.
08-13-2018 04:35 PM - edited 08-13-2018 04:50 PM
PUSH (PSH) is TCP attribute of same kind as RST. Just other bit of same byte of TCP header. Read here for more. Both attributes (and even others) are shown in Wireshark (PSH is so common, so it's not shown on INFO column, but is shown in packet details).
RST always mean aborted connection and should not be seen in typical stream (if seen, such connection is over).
08-13-2018 04:24 PM
as far as i know, push must be a term Cisco uses, TCP RST (Reset) is something you will see in wireshark.
08-13-2018 04:35 PM - edited 08-13-2018 04:50 PM
PUSH (PSH) is TCP attribute of same kind as RST. Just other bit of same byte of TCP header. Read here for more. Both attributes (and even others) are shown in Wireshark (PSH is so common, so it's not shown on INFO column, but is shown in packet details).
RST always mean aborted connection and should not be seen in typical stream (if seen, such connection is over).
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: