 | 1 | initial version |
Why do you think PSH indicates when a session has finished with a message?
There is no notion of "messages" in TCP; TCP is a byte-stream protocol, with no message boundaries - protocols that send messages over TCP use conventions within the protocol to determine message boundaries. A common technique is to have each message start with a message length field; other techniques, for text-style protocols such as FTP, HTTP, etc. is either to use a line ending as a message end (for messages that fit in one line) or to use a blank line to separate message headers from the message body (used by, for example, HTTP - which can also use Content-Length headers as a message length field for the message body).
If your protocol does not have such a mechanism, you need to modify it to introduce such a mechanism.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
