Push
TCP PSH (Push, bit 4) tells the receiver to push the data in this segment to the application immediately rather than waiting to fill a larger buffer. PSH is a hint to the receiver's TCP stack. Modern implementations typically set PSH on every data segment; it has limited practical effect on well-implemented stacks.
Abbreviation
PSH
Bit Position
4
tcpdump
[P]
Standard
RFC 9293
Description
The PSH flag was originally designed to allow the sender to signal that buffered data should be flushed to the receiving application without waiting for more data to arrive. This was important for interactive applications like Telnet where each keystroke needed to be delivered immediately.
In modern implementations, PSH has limited operational significance. Linux's TCP stack delivers data to the application as soon as it arrives regardless of PSH. The flag is more useful as a hint to packet analyzers: a segment with PSH set indicates the end of a logical message boundary in the data stream.
Tools like Wireshark use PSH as a visual indicator of message boundaries. HTTP request and response boundaries typically correspond to PSH-flagged segments. tcpdump output showing [P.] means PSH+ACK, which is by far the most common pattern for data segments in any TCP session.
Key Flag Combinations
| Flags | Meaning |
|---|---|
| PSH+ACK | Standard data segment – the overwhelming majority of TCP data traffic |
| PSH+FIN+ACK | Last data segment with connection close – rare but valid |
When You See This Flag
- –Application called send() or write() and TCP chose to send immediately
- –TCP_NODELAY enabled, disabling Nagle buffering, causing every write to be sent
- –Last segment of a write that fills the send buffer