I was writting a java (jpcap) application that distinguishes which response packet was for which request packet. suddenly I encounter these two http packets that my browser sent exactly the same (seq number, ack number, …) except one of them has push flag and different identification number. I was wondering why browser sent these two? is it Ajax?
1342824149:911270 /192.168.2.#->/174.143.213.# protocol(6) priority(0) hop(128) offset(0) ident(14123) TCP 11303 > 80 seq(2473817076) win(17040) ack 3940549542
1342824149:911797 /192.168.2.#->/174.143.213.# protocol(6) priority(0) hop(128) offset(0) ident(14124) TCP 11303 > 80 seq(2473817076) win(17040) ack 3940549542 P
and more important question, are there separate responses for these two packets? or there is just one response? or same response? and what responses would looks like?
Your browser just says “connect to IP address X on port Y” and “send these bytes”. It’s the TCP/IP stack inside the kernel that’s responsible for actually creating packets and making sure they get to their destination. In this case, the first packet didn’t get acknowledged by the destination, so the TCP code in the kernel sent it again.