When I use the "bytes sent since last PSH flag"?

edit

They are two different things that aren't related, hence the different sizes.

Bytes in flight is the number of bytes transmitted since the last ACK received.

Bytes since the last PSH flag is the number of transmitted since the last segment with the PSH flag set was transmitted. Some info on how the PSH flag is handled by both sender and receiver can be found here.

When the sender wants the receiver to send all its data in its buffer to the application, it will send a TCP PUSH. There are usually two reasons for this: the TCP CWND is full or it is time sensitive application. It is expected that the receiver will respond with an updated ACK. If there is no response, there could be a problem. The exception if it is a FIN or RESET. The bytes in flight, are bytes that Wireshark hasn't seen an ACK for. It's important to know the location of the sniffer because it affects when Wireshark sees the response to the TCP PUSH.