TCP Flags Reference
TCP flags and connection states reference guide.
Initiates a connection. Used in the three-way handshake to synchronize sequence numbers.
Use cases: Connection establishment, port scanning
Acknowledges receipt of data. Almost all packets after the initial SYN have ACK set.
Use cases: All established connection packets, connection teardown
Indicates no more data from the sender. Initiates the four-way connection teardown.
Use cases: Graceful connection termination
Abruptly terminates a connection. Sent when an error occurs or connection is refused.
Use cases: Error handling, refusing connections, terminating half-open connections
Tells receiver to pass data to the application immediately without buffering.
Use cases: Interactive applications, real-time data, small payloads
Indicates the urgent pointer field is significant — data should be processed out-of-order.
Use cases: Telnet, SSH interrupt signals, rarely used in modern protocols
Used in Explicit Congestion Notification (ECN). Indicates ECN-capable transport during SYN.
Use cases: Congestion control negotiation and signaling
Sent by host to indicate it received a TCP segment with ECE flag and has reduced its congestion window.
Use cases: Congestion control feedback
About this tool
TCP flags are control signals that manage how data flows and connections are established or terminated in network communication. The six flags—SYN, ACK, FIN, RST, PSH, and URG—each serve a specific purpose in the TCP protocol. Understanding these flags is essential for network engineers, security professionals, and anyone debugging connection issues, as they control the handshake process, determine when data should be delivered immediately, and govern graceful versus abrupt connection closures.
This reference guide provides a visual and searchable lookup of all TCP flags and their meanings. You can quickly understand what each flag does, how it's used in the three-way handshake, and its role in connection teardown and error handling. The guide also covers TCP connection states like ESTABLISHED, TIME_WAIT, and SYN_RECV, giving you a complete picture of how TCP manages the full lifecycle of a connection from initiation to termination.
Frequently Asked Questions
Code Implementation
import socket
import struct
# TCP flags constants
TCP_FIN = 0x01
TCP_SYN = 0x02
TCP_RST = 0x04
TCP_PSH = 0x08
TCP_ACK = 0x10
TCP_URG = 0x20
TCP_ECE = 0x40
TCP_CWR = 0x80
def decode_tcp_flags(flags_byte):
"""Decode TCP flags from a byte"""
flags = []
if flags_byte & TCP_FIN: flags.append('FIN')
if flags_byte & TCP_SYN: flags.append('SYN')
if flags_byte & TCP_RST: flags.append('RST')
if flags_byte & TCP_PSH: flags.append('PSH')
if flags_byte & TCP_ACK: flags.append('ACK')
if flags_byte & TCP_URG: flags.append('URG')
if flags_byte & TCP_ECE: flags.append('ECE')
if flags_byte & TCP_CWR: flags.append('CWR')
return flags
def check_tcp_connection(host, port, timeout=3):
"""Check if TCP port is open (SYN-ACK received)"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(timeout)
result = sock.connect_ex((host, port))
sock.close()
return result == 0 # 0 = connected (SYN-ACK received)
except Exception:
return False
# Common flag patterns
print("SYN packet flags:", decode_tcp_flags(TCP_SYN)) # ['SYN']
print("SYN-ACK flags:", decode_tcp_flags(TCP_SYN | TCP_ACK)) # ['SYN', 'ACK']
print("FIN-ACK flags:", decode_tcp_flags(TCP_FIN | TCP_ACK)) # ['FIN', 'ACK']
print("PSH-ACK flags:", decode_tcp_flags(TCP_PSH | TCP_ACK)) # ['PSH', 'ACK']
# Check if port is open
is_open = check_tcp_connection('example.com', 80)
print(f"Port 80 open: {is_open}")
Comments & Feedback
Comments are powered by Giscus. Sign in with GitHub to leave a comment.