The TCP Flags

Eight bits that steer every connection

Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.

What you'll be able to do

▸Identify SYN, ACK, PSH, FIN, and RST in real packets and state their roles
▸Explain which flag combinations appear at each phase of a connection's life
▸Spot suspicious or impossible flag combinations

Before this lesson — it builds directly on:

Every TCP segment has to answer a question the data itself can't: what is this packet FOR? Is it opening a connection, carrying data, confirming something, or shutting things down? TCP answers with a single byte of on/off switches — the flags. Each bit means one specific thing, they can be combined, and their combinations are what distinguish setup from data from teardown. Learning to read that byte is the fastest way to understand any capture you'll ever open.

✗ Common misunderstanding: The SYN packet carries the first application data.

Why that's wrong: In classic TCP the SYN carries options and the ISN, but no payload — data flows only after the handshake completes. (TCP Fast Open is a separate, later extension.)

Correct model: Handshake first, data second. The SYN's job is synchronising sequence numbers and announcing capabilities.

The packets prove it: Select the SYN in any trace: Len=0, and the payload field is absent entirely.

Watch these fields in the lab: tcp.flags

SYN — synchroniseglossary: Opens a connection by announcing this side's Initial Sequence Number. Appears on exactly two packets in a healthy connection (the SYN and the SYN-ACK) and never again. Consumes one sequence number.
ACK — acknowledgementglossary: Says 'the acknowledgement number in this header is meaningful'. Set on every segment except the very first SYN. Its absence anywhere else is a red flag.
PSH — push: Asks the receiving TCP to deliver buffered bytes to the application promptly rather than waiting for more. A hint about timing, carrying no protocol obligation.
FIN — finishglossary: 'I have no more data to send.' Half-duplex: it closes only this sender's direction, and the other direction may keep flowing. Consumes one sequence number, so it can be acknowledged reliably.
RST — resetglossary: Abort now. No acknowledgement, no reply, nothing preserved. Sent when a segment arrives that makes no sense for any existing connection — most commonly a SYN to a port nobody is listening on.
URG — urgent: Marks a byte offset in the urgent pointer as needing out-of-band attention. Historically used by Telnet interrupts; modern advice (RFC 6093) is not to generate it. If you see it in production traffic, be suspicious.
ECE / CWR — congestion signalling: The two ECN bits. ECE tells a sender that the network marked a packet as congested; CWR confirms the sender reduced its window in response. They let routers signal congestion without dropping anything.

Watch these fields in the lab: tcp.flags.syn · tcp.flags.ack · tcp.flags.psh · tcp.flags.fin · tcp.flags.rst · tcp.flags.urg · tcp.flags.ece · tcp.flags.cwr

✓ Concept check — before you open the packets

These test the idea, not the trace. You should be able to answer them from the explanation above.

Why do SYN and FIN each consume a sequence number when neither carries any data?

You capture traffic and see a client send SYN four times, one second apart, with no reply of any kind. What does the absence of a reply tell you?

Now that you understand the concept, observe how it appears in the packet exchange.

The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.