If the packets captured by wireshark is

28.263227 66 55555 > 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0

28.263228 1514 19745 > 55555 [PSH, ACK] Seq=2897 Ack=1 Win=5760 Len=1448

What is the last byte received on the machine having IP ? Is it 2897+1448 or 2897+1448-1 ? And why is there a PSH flag in the second packet ?

  • is this an exam question? ...if it is, we don't do homework/exam questions. Dec 19, 2014 at 1:33

1 Answer 1


Because 2897 is the sequence number of the first byte in the received segment, the sequence number of the last byte is 2897+1448-1. When this segment is acked, the ACK field will contain 2897+1448 since that is the sequence number of the next byte expected to arrive.

The PSH or push flag indicates that TCP should not buffer this data. In other words, TCP should not wait for more data before transmitting it (sender) or before handing it over to the application (receiver). As to why the flag is there in this case, that is a question for whoever wrote the application or protocol being used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.