Transmission Control Protocol (TCP) is a critical protocol that enables communication between computers over a network. In TCP, data is divided into packets and sent over the network to the receiver.
In this post, we'll explore two TCP flags, PSH and URG, that are used to indicate different types of data — what each flag does, how the PSH flag behaves in more detail, and how the two differ in practice.
TCP is a connection-oriented protocol that ensures reliable communication between two devices. Packets are sent from the sender to the receiver, and the receiver sends an acknowledgement to the sender for each packet received. This process ensures that all packets are received in the correct order, and any lost packets are retransmitted.
TCP uses flags to provide additional information about the packets being sent. There are six flags in TCP, including PSH and URG, which we will discuss in this article.
I strongly recommend checking the Wireshark Course for those who want to see these flags in real packet captures and learn more about this topic.
TCP Overview
TCP is a reliable, connection-oriented protocol that provides several features, including flow control, congestion control, and error detection. In TCP, data is divided into packets and sent over the network to the receiver.
Each packet contains a header and payload. The TCP header contains several fields, including the source and destination ports, sequence and acknowledgement numbers, and flags. The payload contains the data being sent.
TCP Flags
TCP uses six flags to indicate different types of packets. These flags are as follows:
- URG – Indicates that the Urgent Pointer field is valid.
- ACK – Indicates that the Acknowledgement Number field is valid.
- PSH – Indicates that the receiver should push the data to the application layer as soon as it is received.
- RST – Indicates that the connection should be reset.
- SYN – Indicates that a connection should be established.
- FIN – Indicates that a connection should be terminated.
In this article, we will focus on the PSH and URG flags.
PSH Flag
The PSH flag indicates that the receiver should push the data to the application layer as soon as it is received, without waiting for more data to arrive. This flag is often used in real-time applications, such as voice and video streaming, where a delay in data transmission can result in poor user experience.
When the PSH flag is set, the receiver pushes the data to the application layer as soon as it is received, even if the buffer is not full. This reduces the latency and ensures that the data is delivered as quickly as possible.
The PSH Flag in Depth
To understand how PSH differs from URG, it helps to look at what the flag actually does on both ends of the connection.
The PSH flag is a single bit in the flags field of the TCP header. Normally, TCP is free to buffer data on both sides: the sender may collect data from the application until it can build an efficiently sized segment, and the receiver may hold received data in its buffer before handing it to the application. The PSH flag cuts through this buffering in both directions.
When a segment carries the PSH flag, the sender is signaling that it has reached the end of a logical chunk of data — typically the last segment of a block the application wrote. The receiver then delivers everything it has buffered up to that point to the application layer immediately, instead of waiting for more data to arrive. This allows the application to process the data right away, reducing latency and improving responsiveness — which is why the flag matters for interactive and real-time traffic.
One practical point: applications do not normally set the PSH flag themselves. Standard socket APIs do not expose it directly; the TCP stack sets it automatically, typically on the last segment of the data in its send buffer. Socket options such as TCP_NODELAY influence how quickly data is sent out, but they are not the same thing as the PSH flag.
The PSH flag is also worth knowing for network security work. Crafted segments with the PSH flag set appear in certain attack traffic and scanning patterns, so being able to recognize normal versus suspicious PSH behavior in a packet capture is a useful skill when analyzing network communication.
URG Flag
The URG flag indicates that the Urgent Pointer field is valid. The Urgent Pointer field is used to identify a portion of the data that requires immediate attention — it tells the receiver where the urgent data ends within the stream.
When the URG flag is set, the receiver knows that it should process the urgent data first, before processing the rest of the data. This is useful in situations where certain data requires immediate attention, such as control signals or error messages.
Differences between PSH and URG Flags
The main difference between the PSH and URG flags is the type of data they indicate. The PSH flag indicates that the data should be pushed to the application layer as soon as it is received, while the URG flag indicates that certain data requires immediate attention.
Another difference is the urgency of the data. Data with the PSH flag set is important but not urgent, while data with the URG flag set requires immediate attention.
PSHURG PurposeDeliver buffered data to the application immediatelyMark data that requires immediate attention Header fields involvedFlags bit onlyFlags bit plus the Urgent Pointer field Effect on the receiverPushes data up to the application without waiting to fill the bufferSignals that urgent data should be handled before the rest Who sets itSet automatically by the TCP stackRequested by the application through the urgent mechanism Typical usageInteractive and real-time traffic; very commonControl-type signals; rarely used in modern applicationsUse Cases of PSH and URG Flags
The PSH and URG flags are used in different scenarios. The PSH flag is often used in real-time applications, such as voice and video streaming, where a delay in data transmission can result in poor user experience. The PSH flag ensures that the data is delivered to the application layer as quickly as possible, reducing the latency.
The URG flag is used when certain data requires immediate attention. This is useful in situations where control signals or error messages need to be processed immediately. A classic example is remote terminal protocols such as Telnet, where an interrupt keystroke is sent as urgent data so the remote side can react to it without first working through everything queued ahead of it.
In practice, the urgent mechanism is rarely used by modern applications, and its use in new designs is discouraged (see RFC 6093). The PSH flag, by contrast, appears constantly in everyday TCP traffic.
Conclusion
In conclusion, the PSH and URG flags are important TCP flags that indicate different types of data. The PSH flag indicates that the data should be pushed to the application layer as soon as it is received, while the URG flag indicates that certain data requires immediate attention. Both flags are useful in different scenarios, and their proper use can improve the performance of applications that use TCP.
If you want to learn more about TCP, network security, and other related topics, you should check out Orhan Ergun's networking courses. These courses cover a wide range of topics, from TCP/IP fundamentals to advanced network security techniques.
