Logo

MonoCalc

/

TCP Flag Decoder

Networking

Common TCP Flag Combinations

About This Tool

TCP Flag Decoder – Understanding TCP Control Bits

Every TCP segment carries a set of control flags packed into a single byte of the segment header. These flags govern connection establishment, data delivery, flow control, and connection teardown. The TCP Flag Decoder lets you enter any flag byte value — in decimal, hexadecimal, or binary — and instantly see which of the eight defined flags are set, along with a plain-English description of each flag's purpose and any matching well-known pattern.

The Eight TCP Flags

The original six flags were defined in RFC 793 (1981). Two additional flags were introduced by RFC 3168 (2001) to support Explicit Congestion Notification (ECN). From the most significant bit to the least:

  • CWR (bit 7) — Congestion Window Reduced. Set by the sender to confirm it received an ECE signal and has reduced its transmission rate. Part of the ECN feedback loop.
  • ECE (bit 6) — ECN-Echo. During the SYN handshake, ECE+SYN advertises ECN capability. In an established session, it signals that the receiver detected congestion in the network path.
  • URG (bit 5) — Urgent. Marks the Urgent Pointer field as valid, directing the receiver to process out-of-band data ahead of the normal stream. Rarely used in modern applications.
  • ACK (bit 4) — Acknowledgment. Present in virtually every TCP segment after the opening SYN. Indicates that the Acknowledgment Number field contains a valid value confirming data receipt.
  • PSH (bit 3) — Push. Instructs the receiver to deliver buffered data to the application immediately instead of waiting for the buffer to fill. Commonly set on the last segment of an HTTP request or response.
  • RST (bit 2) — Reset. Abruptly terminates the connection without waiting for a FIN handshake. Used when a port is unreachable, a packet is invalid, or an application encounters a fatal error.
  • SYN (bit 1) — Synchronize. Initiates a connection. The client sends the first SYN-only packet, the server replies with SYN-ACK, and the client completes the three-way handshake with ACK.
  • FIN (bit 0) — Finish. Signals that the sender has no more data to send and requests a graceful connection close. Each side sends its own FIN, resulting in a four-way teardown sequence.

Reading TCP Flags in Packet Captures

When analysing packet captures in tools like Wiresharkor tcpdump, the TCP flags field appears in the TCP header as a single byte (or sometimes two bytes when the reserved bits are included). Common notation formats you will encounter:

  • Flags: 0x012 — hexadecimal; the decoder accepts this directly.
  • [SYN, ACK] — Wireshark's decoded view; convert mentally to 0x12 (decimal 18).
  • Flags [S.] — tcpdump shorthand: S = SYN,. = ACK, F = FIN, R = RST,P = PSH, U = URG.

Common Patterns and What They Mean

Most TCP traffic follows a small set of recurring flag combinations:

  • SYN (0x02, decimal 2): Connection open request.
  • SYN-ACK (0x12, decimal 18): Server acknowledges the connection request and sends its own SYN.
  • ACK (0x10, decimal 16): The most common packet in any established session — confirms received data.
  • PSH-ACK (0x18, decimal 24): Data delivery with push — typical for HTTP, SSH, and most application-layer protocols.
  • FIN-ACK (0x11, decimal 17): Graceful connection close combined with an acknowledgment.
  • RST (0x04, decimal 4): Abrupt reset, often seen from firewalls or when connecting to a closed port.

Security-Relevant Flag Combinations

Network security tools use unusual flag combinations to fingerprint operating systems or probe for open ports without completing a full handshake:

  • NULL scan (0x00): No flags set. Per RFC 793, a closed port must reply with RST; an open port silently drops the packet. Used in stealth port scanning.
  • Xmas scan (0x29 or 0x3F): FIN+PSH+URG or all six classic flags set. Named for the "lit-up" appearance in packet analysers. Has the same RST/silence response as the NULL scan.
  • FIN scan (0x01): Only FIN is set, bypassing simple stateless firewall rules that block SYN packets.

Modern intrusion detection systems (IDS) and stateful firewalls recognise these patterns and generate alerts or drop the packets automatically.

How the Decoder Works

The decoder performs a simple bitwise AND test between your input value and a mask for each flag's bit position. For example, to check whether the SYN flag is set in the value 0x12 (binary 00010010):

0x12 AND 0x02 = 0x02 ≠ 0 → SYN is set.
0x12 AND 0x10 = 0x10 ≠ 0 → ACK is set.
All other positions evaluate to zero, so only SYN and ACK are active.

You can enter values in decimal (e.g. 18), hexadecimal (e.g. 0x12), or as an 8-bit binary string (e.g. 00010010). All three formats produce the same result.

Frequently Asked Questions

Is the TCP Flag Decoder free?

Yes, TCP Flag Decoder is totally free :)

Can I use the TCP Flag Decoder offline?

Yes, you can install the webapp as PWA.

Is it safe to use TCP Flag Decoder?

Yes, any data related to TCP Flag Decoder only stored in your browser (if storage required). You can simply clear browser cache to clear all the stored data. We do not store any data on server.

How does the TCP Flag Decoder work?

Enter a TCP control byte value in decimal (0–255), hexadecimal (e.g. 0x12), or 8-bit binary (e.g. 00010010). The tool performs a bitwise AND check against each of the 8 flag bit positions (FIN, SYN, RST, PSH, ACK, URG, ECE, CWR) and shows which flags are set, along with a description of each flag and any well-known pattern match.

What are the 8 TCP flags and what do they mean?

The original 6 flags defined in RFC 793 are FIN (graceful close), SYN (connection initiation), RST (reset/abort), PSH (push data to application), ACK (acknowledgment), and URG (urgent data). RFC 3168 added ECE (ECN-Echo, signals network congestion) and CWR (Congestion Window Reduced, acknowledges ECN signal). Together they form an 8-bit control field in every TCP segment header.

What does a SYN-ACK packet mean?

A SYN-ACK packet (flags value 0x12, decimal 18) is the server's response in the TCP three-way handshake. It confirms the client's SYN and simultaneously sends the server's own SYN to synchronise sequence numbers. The client then replies with an ACK (0x10) to complete the handshake and establish the connection.

Why is the RST flag used?

RST (Reset) abruptly terminates a TCP connection without the normal four-way FIN handshake. Common causes include: a packet arriving for a port that has no listening service, a firewall dropping and resetting a session, a timeout-triggered connection cleanup, or an application-level error requiring immediate abort. A RST-ACK (0x14) combination is often seen when a peer resets a half-open connection.

What are NULL and Xmas scans?

NULL (0x00) and Xmas (0x29 or 0x3F) scans are TCP port-scanning techniques that exploit RFC 793's behaviour on closed ports. A closed port should respond with RST to any malformed flag combination, while an open port typically ignores it. Firewalls and modern operating systems often block or log these anomalous packets. They are commonly used by tools like nmap for stealth reconnaissance.

What is ECN and when are the ECE and CWR flags used?

Explicit Congestion Notification (ECN, RFC 3168) allows routers to signal congestion without dropping packets. During the SYN handshake, a client signals ECN capability by setting ECE+CWR. In an active session, a router marks a packet's IP header (CE bit); the receiver then sets ECE in its ACK to notify the sender, which reduces its congestion window and replies with CWR set to acknowledge the reduction.