Course contents

Unit 7: TCP, UDP and PortsLesson 7.1.3 (3 of 23 in this unit)52 of 104 in the Network Fundamentals course

TCP flags

SYN, ACK, FIN, RST, PSH, URG, ECE and CWR, the combinations in a capture and how to filter for them.

Intermediate · 7 min read

Covers Flags, Capture filters and SYN flood.

Technical definition

TCP flags are single-bit fields in the TCP header that say what kind of segment this is and which other header fields are valid. A segment can carry several flags at once, such as SYN and ACK together in the second step of the handshake.

What a flag is

Right after the data offset, the TCP header has a block of single-bit flags. Each one is either 0 or 1. Together they answer two questions about the segment: what is it for (open, close, abort, ordinary data) and which other fields should the receiver trust (for instance, the acknowledgement number is only meaningful when ACK is set).

The eight TCP flags and what each one means
The eight TCP flags and what each one meansSYN opens a connection, ACK says the acknowledgement number is valid, FIN closes a direction, RST aborts, PSH asks for prompt delivery, URG marks the urgent pointer valid, ECE and CWR support explicit congestion notification.SYN 0x02Open a connection andagree sequence numbersfirst handshake segmentsACK 0x10Acknowledgement numberis validall after the first SYNFIN 0x01No more data to send:close this directionconnection closeRST 0x04Abort now: no suchconnection or closed portrefused or brokenPSH 0x08Hand the data to theapplication promptlyinteractive trafficURG 0x20Urgent pointer is valid(rarely used today)legacy and a few toolsECE 0x40ECN echo: receiver sawcongestion marked in IPECN-capable pathsCWR 0x80Congestion window cut:sender has slowedECN-capable paths
Flags sit in the second 16-bit word of the header with the data offset. The common combinations are SYN, SYN+ACK, ACK, FIN+ACK and RST. The hex value is the flag's bit value in the flags byte: SYN+ACK is 0x12.

The flags one at a time

  • SYN (synchronise): opens a connection. Set in the first segment from each side, which carries that side's initial sequence number. It uses up one sequence number.
  • ACK (acknowledge): the acknowledgement number field is valid. Set on every segment after the first SYN, so most segments on the wire carry it.
  • FIN (finish): the sender has no more data. Each direction is closed with its own FIN, and it also uses up one sequence number.
  • RST (reset): abort the connection immediately. Sent when a segment arrives for a port nobody is listening on, or for a connection the host does not know.
  • PSH (push): deliver the data to the application now instead of waiting to fill a buffer. Common at the end of a request or response.
  • URG (urgent): the urgent pointer field is valid. Almost never used by modern software.
  • ECE and CWR: explicit congestion notification. A router marks packets instead of dropping them, the receiver echoes the mark with ECE, and the sender confirms it has slowed down with CWR.

Combinations you will see

Common flag combinations
Common flag combinationsFlags; tcpdump; Meaning; Where it appears. SYN: [S] Open a connection Step 1 of the handshake, from the client SYN + ACK: [S.] Accept, and open the other direction Step 2, from the server ACK: [.] Acknowledge data or complete the handshake Step 3, and most segments after it PSH + ACK: [P.] Data, deliver promptly, and acknowledge A request or response in the middle of a connection FIN + ACK: [F.] I am finished sending; acknowledge Closing, once from each side RST: [R] or [R.] Abort: no such connection or port closed A refused connection, or a broken oneFlagstcpdumpMeaningWhere it appearsSYN[S]Open a connectionStep 1 of the handshake,from the clientSYN + ACK[S.]Accept, and open theother directionStep 2, from the serverACK[.]Acknowledge data orcomplete the handshakeStep 3, and most segmentsafter itPSH + ACK[P.]Data, deliver promptly,and acknowledgeA request or response inthe middle of aconnectionFIN + ACK[F.]I am finished sending;acknowledgeClosing, once from eachsideRST[R] or [R.]Abort: no such connectionor port closedA refused connection, ora broken one

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read the first column across: the flags set in the segment, how tcpdump prints them, what they mean and where they appear.

Reading flags in a capture

# tcpdump: only segments that open a connection (SYN without ACK) tcpdump -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn' # Wireshark display filters tcp.flags.syn == 1 && tcp.flags.ack == 0 tcp.flags.reset == 1

Counting SYNs without matching SYN-ACKs shows a host being scanned or a server that is not answering. A burst of RSTs from one address means the port is closed or a firewall is rejecting with reset.

Example output · based on Cisco documentation; exact format varies by platform and software version
$tcpdump -nn -i eth0 tcp port 443
10:01:02.100 IP 192.0.2.10.51514 > 198.51.100.20.443: Flags [S], seq 1000, win 64240, length 0
10:01:02.130 IP 198.51.100.20.443 > 192.0.2.10.51514: Flags [S.], seq 7000, ack 1001, win 65535, length 0
10:01:02.130 IP 192.0.2.10.51514 > 198.51.100.20.443: Flags [.], ack 7001, win 502, length 0
Example output using documentation addresses: the three-way handshake as [S], [S.] and [.]. The acknowledgement numbers are one higher than the sequence numbers because SYN uses one number.

Unusual flags and what they suggest

  • No flags at all (a "null" segment) and FIN+PSH+URG (an "Xmas" segment) are not valid in a real conversation. Scanners send them to see how a stack answers.
  • Many SYNs, few ACKs can be a SYN flood: the attacker never completes the handshake, so the server's half-open connection table fills. SYN cookies are the usual defence.
  • RST in reply to your SYN means the port is closed. Silence usually means a firewall dropped it.

TCP flags in short

  • SYN opens, FIN closes a direction, RST aborts, ACK acknowledges.
  • SYN+ACK is flag value 0x12; ACK alone is 0x10.
  • SYN and FIN each use one sequence number; a plain ACK uses none.
  • PSH asks for prompt delivery; URG and its pointer are legacy.

Test yourself

Predict · scenario 1

A server receives a segment for port 8080, where nothing is listening. Which flag does its reply carry?

Predict · scenario 2

Which flags make up the second step of the three-way handshake?

Predict · scenario 3

tcpdump shows Flags [P.] on a segment. Which flags are set?

Predict · scenario 4

What does a flood of SYN segments with no final ACK usually indicate?

Predict · scenario 5

Which flag tells the receiver that the acknowledgement number field is meaningful?

FAQ

How many flags does TCP have?
Eight in the original header plus ECE and CWR for congestion notification, so the flags field holds CWR, ECE, URG, ACK, PSH, RST, SYN and FIN. A ninth bit, NS, was added experimentally by RFC 3540 and is rarely seen.
Why do captures show SYN as [S] and SYN-ACK as [S.]?
tcpdump writes each flag as a letter and uses a dot for ACK. [S] is SYN, [S.] is SYN plus ACK, [.] is a plain ACK, [P.] is PSH plus ACK, [F.] is FIN plus ACK and [R] is RST.
Is a segment with both SYN and FIN valid?
No. It never occurs in normal traffic, so firewalls and intrusion prevention systems commonly drop it. Unusual combinations are a standard way to probe a host.