Open my workstand

PDF tools

Image tools

Spreadsheet & data tools

Writing & text tools

Converters

Calculators

Design tools

Productivity tools

Audio & video tools

Developer tools

Free workspace: documents, spreadsheets, calendar, notes and projects saved in a folder on your computer. Learn more about the workspaceBrowse all 937 tools
  1. Home
  2. Developer tools
  3. TCP Flags Decoder

TCP Flags Decoder

Turn a number like 0x12 into SYN and ACK, or choose flags to see the value. Combinations that normal traffic never uses are explained.

Free, no sign-up. Runs in your browser: nothing is uploaded.

How to use TCP Flags Decoder

  1. Enter the flags as decimal, 0x hex or 0b binary, or tick the flags.
  2. Read the flags and their meaning.
  3. Check the table of the nine bits.

Features

  • All nine flag bits including NS, CWR and ECE
  • Decimal, hex and binary input
  • Plain-language meaning of common combinations
  • Detects NULL, Xmas and invalid combinations
  • Quick buttons for typical segments
  • Bit values table

Supported formats

Input

  • Flag byte or letters

You get

  • Set flags
  • Meaning of the combination

Private by design

Everything you enter is processed by your browser on this device. Nothing is sent to openWorkstand or anyone else, so the TCP Flags Decoder is safe for private and work data. After you have used it once while online, it also works without an internet connection. How local processing works

Good to know

  • It decodes the nine flag bits of the header; it cannot tell from a single packet whether a scan is under way.
  • The reserved bits are shown but not interpreted.

Guide

Reading the TCP flag byte: SYN, ACK, FIN and the rest

Every TCP segment carries a handful of flag bits that say what kind of segment it is: the start of a connection, a data segment, an acknowledgement, a close. Reading them from a capture, a firewall log or a textbook number is a basic troubleshooting skill. The page translates a flags value into names and meanings, and works in reverse by letting you tick the flags.

The nine flags

Counting from the low end: FIN (0x01) means the sender has finished. SYN (0x02) opens a connection and carries the initial sequence number. RST (0x04) aborts the connection. PSH (0x08) asks the receiver to hand data to the application at once. ACK (0x10) says the acknowledgement number is valid, which is true for every segment after the first. URG (0x20) marks the urgent pointer as significant and is almost never used. ECE (0x40) and CWR (0x80) support explicit congestion notification, and NS (0x100) is an experimental nonce extension (RFC 3540). Most captures show only the low eight bits.

Entering a value

Type the flags field in decimal, as 0x12, or in binary as 0b10010, or choose the quick buttons: SYN, SYN+ACK, ACK, PSH+ACK, FIN+ACK, RST and RST+ACK. Or tick any combination of the nine flags. The result lists the flags that are set, the value in decimal, hex and nine-bit binary, a plain-language meaning, and a table of all nine with their values, a tick for those set and a description.

What normal traffic looks like

A connection starts with a SYN (0x02), is answered by a SYN+ACK (0x12) and completed by an ACK (0x10). Data flows in ACK (0x10) or PSH+ACK (0x18) segments. One side closes with FIN+ACK (0x11) and the other responds the same way, followed by a final ACK, or either side aborts with RST (0x04) or RST+ACK (0x14). Anything else is unusual. A segment with no flags (NULL), with FIN, PSH and URG set (Xmas) or with SYN and FIN together is not part of any normal conversation. Scanners use them to probe how a host’s stack reacts, and many firewalls drop them.

A worked example

The sample is 18. The page shows the flags set as ACK, SYN, the value as 18 / 0x012 / 000010010 in decimal, hex and binary, and the meaning “Connection accepted: the second packet of the handshake”. In the table, ACK (0x010) and SYN (0x002) are ticked and the other seven flags are not. Adding the PSH flag (0x08) to the ACK gives 0x18, which is a data segment.

Limits

Flags alone do not tell the whole story. Whether a SYN is a scan or a normal client depends on what follows, and on state that a single packet does not show. The decoder explains the bits but cannot see sequence numbers, windows or timing. For a complete packet, paste the bytes into the Packet Header Decoder, which shows the flags in context. Building a capture filter for a particular flag is the job of the Wireshark Filter Builder.

Checked against the current version of the TCP Flags Decoder on .

Frequently asked questions

What is the difference between FIN and RST?

FIN closes a connection politely: the sender has no more data, and the other side still may finish sending. RST aborts it at once and discards anything in flight, which is also how a host answers a packet for a port nothing is listening on.

Why do captures often show the flags as [S.] or [P.]?

That is tcpdump notation: S is SYN, F is FIN, P is PSH, R is RST and a full stop stands for ACK, so [S.] means SYN+ACK.

What does 0x12 mean?

SYN and ACK: the server’s answer in the second step of the three-way handshake.

Why are SYN+FIN and NULL packets suspicious?

They never occur in normal TCP. Port scanners send them to probe how a host or firewall responds, so many firewalls drop them.

Keep working with the result

openWorkstand also includes a free workspace with documents, spreadsheets, tasks, projects and a calendar that save to a folder on your computer.

How the workspace worksOpen my workstand

More developer tools

JSON to Rust Serde Structserde structs from sample JSON.JSON to Pydantic & dataclassPydantic v2 models and dataclasses from JSON.JSON to Java RecordJava records with Jackson annotations from JSON.JSON to Kotlin Data Classkotlinx.serialization data classes from JSON.JSON to C# RecordC# records with JsonPropertyName from JSON.JSON to Swift CodableSwift Codable structs from sample JSON.JSON to Dart ClassFlutter model classes with fromJson and toJson.TypeScript to Zod / ValibotZod or Valibot schemas from TypeScript types.

All developer tools