tcpdump mailing list archives

Re: TCP Header Flags


From: Francois-Xavier Le Bail <devel.fx.lebail () orange fr>
Date: Sun, 19 Feb 2023 13:34:04 +0100

On 18/02/2023 21:51, Denis Ovsienko wrote:
On Sat, 18 Feb 2023 17:06:29 +0100
Francois-Xavier Le Bail <devel.fx.lebail () orange fr> wrote:

Hello,

https://www.rfc-editor.org/rfc/rfc9293 states:
"Control bits:

    The control bits are also known as "flags". Assignment is managed
by IANA from the "TCP Header Flags" registry [62]. The currently
assigned control bits are CWR, ECE, URG, ACK, PSH, RST, SYN, and FIN."

(All on three characters.)

To be in sync with it, we could use 'tcp-psh' in addition to
'tcp-push' in libpcap scanner.l, and in pcap-filter.7 and tcpdump.1
man pages.

That's an interesting point.  Adding "tcp-psh" would certainly restore
consistency with the registry on one hand.  On the other, for backward
compatibility reasons "tcp-push" would have to remain a valid alias for
who knows how many years.

We could keep "tcp-push" indefinitely...

I wonder if there would be any other incurred future maintenance.

The fact tcpdump(1) prose says "PUSH" instead of "PSH" may be related
to the origin of this discrepancy.  Perhaps this is the only part that
can be fixed immediately without unwanted side effects.

There is not even consistency in the tcpdump man page (PUSH and PSH):
$ git grep -En '\<(PSH|PUSH)\>' tcpdump.1.in
tcpdump.1.in:1322:F (FIN), P (PUSH), R (RST), U (URG), W (ECN CWR), E (ECN-Echo) or
tcpdump.1.in:1389:The PUSH flag is set in the packet.
tcpdump.1.in:1415:.I CWR | ECE | URG | ACK | PSH | RST | SYN | FIN
tcpdump.1.in:1486:left, so the PSH bit is bit number 3, while the URG bit is number 5.


_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s


Current thread: