Parse TCP Packets Online
ByteLens TCP Packet Parser turns a raw TCP segment hex dump into a readable header breakdown. Paste a SYN, SYN-ACK, ACK, FIN, or data segment to inspect ports, sequence numbers, acknowledgment numbers, flags, window size, checksum, urgent pointer, and TCP options. The byte grid highlights each field so you can map the decoded values back to the original packet bytes.
TCP Header Format
A TCP header is at least 20 bytes and can grow to 60 bytes when options are present. The data offset field tells the receiver where the payload begins. The parser shows the fixed header fields first, then displays options and payload bytes when they are available in the pasted segment.
| Field | Size | Meaning |
|---|---|---|
| Source Port | 16 bits | Application port used by the sender. |
| Destination Port | 16 bits | Application port used by the receiver. |
| Sequence Number | 32 bits | Identifies the first byte of data in this segment. |
| Acknowledgment Number | 32 bits | Next sequence number expected from the peer when ACK is set. |
| Data Offset | 4 bits | TCP header length in 32-bit words. |
| Flags | 9 bits | Control bits such as SYN, ACK, FIN, RST, PSH, and URG. |
| Window Size | 16 bits | Receive window advertised for flow control. |
| Checksum | 16 bits | Integrity check covering TCP header, payload, and pseudo-header. |
TCP Flags: SYN, ACK, FIN, RST, PSH, URG
| Flag | Purpose | Common use |
|---|---|---|
| SYN | Starts a connection and synchronizes sequence numbers. | First and second steps of the TCP three-way handshake. |
| ACK | Acknowledges received data or handshake progress. | Most packets after the initial SYN. |
| FIN | Requests an orderly connection close. | Normal TCP shutdown. |
| RST | Resets a connection immediately. | Rejected or aborted connections. |
| PSH | Asks the receiver to deliver buffered data promptly. | Interactive or latency-sensitive application data. |
| URG | Marks urgent data when the urgent pointer is meaningful. | Rare legacy urgent data behavior. |
TCP SYN Packet and Three-Way Handshake
A TCP connection normally begins with a SYN packet, continues with a SYN-ACK packet, and is confirmed by a final ACK. In the parser, a SYN segment shows the initial sequence number and usually includes options such as maximum segment size, selective acknowledgment support, and window scaling.
Sequence and Acknowledgment Numbers
TCP sequence numbers track bytes sent across the connection, while acknowledgment numbers report the next byte expected from the other side. SYN and FIN each consume one sequence number even when they do not carry application payload. This is why the ACK in the third handshake step usually acknowledges the peer initial sequence number plus one.
TCP Checksum, Window Size, and Options
The TCP checksum helps detect corrupted segments by covering the TCP header, payload, and an IP pseudo-header. Window size supports flow control by advertising how much data the receiver can accept. TCP options extend the base header with values such as MSS, window scale, timestamps, and selective acknowledgment. For a field-by-field reference, read the TCP header guide or compare flag meanings in the TCP flags glossary.