Understanding of TCP flags

 TCP flags are control bits in the TCP header that manage how TCP connections are established, maintained, and terminated. There are 9 TCP flags in modern TCP:

FlagFull NamePurpose
SYNSynchronizeInitiates a TCP connection and synchronizes sequence numbers.
ACKAcknowledgmentIndicates the acknowledgment field is valid. Used in most TCP packets after connection setup.
FINFinishGracefully terminates a TCP connection.
RSTResetAbruptly terminates or rejects a connection.
PSHPushRequests immediate delivery of data to the receiving application.
URGUrgentIndicates urgent data is present; the Urgent Pointer is valid.
ECEECN EchoUsed with Explicit Congestion Notification (ECN) to indicate network congestion.
CWRCongestion Window ReducedIndicates the sender has reduced its congestion window after receiving an ECE.
NSNonce SumRarely used; supports ECN protection (experimental/obsolete in practice).

Common TCP Flag Combinations

FlagsMeaning
SYNConnection request
SYN, ACKConnection accepted
ACKAcknowledgment of received data
PSH, ACKData should be immediately passed to the application
FIN, ACKGraceful connection termination
RST, ACKForcefully reset the connection

TCP Three-Way Handshake

Client                      Server
  | ------ SYN ------------> |
  | <---- SYN, ACK --------- |
  | ------ ACK ------------> |
Connection Established

TCP Connection Termination (Four-Way Handshake)

Client                      Server
  | ------ FIN ------------> |
  | <------- ACK ----------- |
  | <------ FIN ------------ |
  | ------- ACK -----------> |
Connection Closed

TCP Flags in Wireshark

Some common Wireshark representations are:

  • [SYN]
  • [SYN, ACK]
  • [ACK]
  • [PSH, ACK]
  • [FIN, ACK]
  • [RST]

Typical Uses

  • SYN: Start a connection.
  • ACK: Confirm receipt of packets.
  • FIN: Close a connection gracefully.
  • RST: Immediately terminate a connection (e.g., closed port or protocol error).
  • PSH: Deliver data to the application without waiting.
  • URG: Mark urgent data (rarely used today).
  • ECE/CWR: Handle congestion using ECN.
  • NS: Experimental; seldom seen in modern networks.

Understanding these flags is essential for troubleshooting TCP connections, analyzing packet captures, and detecting network scans or attacks such as SYN floods or TCP reset attacks.

Comments

Post a Comment

Popular posts from this blog

🖧 VLAN (Virtual Local Area Network)

  🖧 VLAN (Virtual Local Area Network) 🧠 Top 5 Key Points Logical Network Segmentation: VLANs divide a physical network into multiple logical networks , thus breaking broadcast domain. Improved Security: Devices in different VLANs cannot communicate unless explicitly allowed via a router or Layer 3 switch . Reduces Broadcast Domains: Each VLAN is its own broadcast domain , minimizing unnecessary traffic. Better Management: Departments (HR, Sales, IT, etc.) can be grouped into different VLANs without changing physical cabling . Requires VLAN Tagging (802.1Q): VLAN information is carried between switches using 802.1Q trunking . VLAN Benefits: Improved security by isolating sensitive systems  Reduced broadcast traffic and better performance Smaller broadcast domains mean less unnecessary traffic and bandwidth saved.. Easy to troubleshoot.  Trunk can carry traffic for up to 4094 VLAN IDs ( ie 4094 subinterfaces ). . Complete Flow PC1 (No Tag) | ...
Read more

🌐 NAT (Network Address Translation)

Image
  🌐 NAT (Network Address Translation) 🧠 Top 6 Key Points Translates Private IPs to Public IPs: NAT converts internal (private) IP addresses into a single or multiple public IPs so that devices inside a LAN can access the Internet. Conserves Public IP Addresses: NAT allows multiple internal hosts to share one public IP, saving global address space. Improves Security: Internal IPs remain hidden from the outside world, reducing attack exposure. Types of NAT: Static NAT: One-to-one mapping (internal ↔ public).  ( Server) Dynamic NAT: Many-to-many mapping (pool of public IPs).  (  PAT (NAT Overload): Many-to-one mapping (most common).  Configured on Routers: NAT runs on routers at the boundary between private and public networks , translating IPs for outbound/inbound traffic. NAT Type Used Today 6 Common Use Static NAT ✅ Yes  (limited use 7 Publishing internal servers with a dedicated public IP Dynamic NAT ⚠️ Rarely L...
Read more

🛰️ OSPF (Open Shortest Path First)

  🛰️ OSPF (Open Shortest Path First) 🧠 Top 5 Key Points about OSPF Link-State Protocol → OSPF shares detailed information about network topology (not just hop count). Metric: Uses cost , calculated based on bandwidth (higher bandwidth = lower cost). Fast Convergence: Quickly detects and adapts to network changes. Supports VLSM & CIDR: Fully classless , allowing subnet flexibility. Area-Based Design: Supports hierarchical networks (Area 0 = Backbone, others connect to it). ⚙️ Additional Notes Works at Layer 3 (Network Layer) of the OSI model. Uses Dijkstra’s SPF (Shortest Path First) algorithm. Multicast addresses: 224.0.0.5 → All OSPF routers 224.0.0.6 → Designated Router (DR) and Backup DR OSPF uses Link-State Advertisements (LSAs) to exchange topology information. Each LSA type has a specific purpose. Here's a practical explanation of LSA Types 1–7 . 1. Type 1 – Router LSA Generated by: Every OSPF router Flooded within...
Read more