TCP Flags List - SYN, ACK, FIN, RST, PSH, URG, ECE, CWR
TCP flags are control bits that describe connection state and behavior. They explain whether a packet starts a connection, acknowledges data, closes a stream, resets a connection, or signals congestion support.
Key Takeaways
SYN starts a connection and ACK confirms received data.
FIN closes a connection gracefully; RST aborts it immediately.
PSH and URG relate to delivery behavior and urgent data.
ECE and CWR are used with explicit congestion notification.
Core TCP flags
The most commonly inspected flags are SYN, ACK, FIN, and RST. These flags explain most connection setup, normal teardown, and failure behavior seen in packet captures.
Reading flag combinations
TCP flags are often combined. SYN-ACK is the server side of the three-way handshake. FIN-ACK appears during graceful shutdown. RST-ACK often indicates a refused or aborted connection.
How flags help troubleshooting
Repeated SYN packets can indicate connection failure. RST may indicate a closed port or rejected flow. FIN sequences show graceful close behavior. ACK-only packets often carry acknowledgment or window updates.
Practical Reference
| Item | Value | Analysis Note |
|---|---|---|
| SYN | Start connection | Synchronizes sequence numbers. |
| ACK | Acknowledge data | Present in most established packets. |
| FIN | Graceful close | Sender has no more data. |
| RST | Reset connection | Abort immediately. |
| PSH | Push data | Request prompt delivery to application. |
FAQ
Can multiple TCP flags be set at once?
Yes. TCP flags are bits, so combinations such as SYN-ACK, FIN-ACK, and RST-ACK are normal.
Which TCP flag means a port is closed?
A reset response often indicates the connection was refused or aborted, though context matters.