After an HTTP handshake the same TCP connection carries small frames in both directions, so the server can push without being asked. It is defined in RFC 6455.