What are the TCP flags and when is each one set?
Show the answer
Say this first
There are eight in common use. SYN opens a connection and carries the initial sequence number. ACK says the acknowledgment field is valid and is set on every segment after the first SYN. FIN closes one direction gracefully. RST aborts the connection immediately. PSH asks the receiver to hand data to the application without waiting. URG marks urgent data and is almost unused. ECE and CWR carry explicit congestion notification signals.
Go deeper
What each flag means
| Flag | tcpdump | Meaning |
|---|---|---|
| SYN | S | Synchronize sequence numbers. Consumes one sequence number. |
| ACK | . | Acknowledgment number is valid |
| FIN | F | No more data from this side. Consumes one sequence number. |
| RST | R | Abort. No ACK is expected and the receiver drops the connection state. |
| PSH | P | Push buffered data up to the application now |
| URG | U | Urgent pointer is valid |
| ECE | E | ECN echo: a packet was marked CE (or, in a SYN, "I support ECN") |
| CWR | W | Congestion window reduced: sender has reacted to ECE |
Common combinations in a capture
[S]client SYN,[S.]SYN-ACK,[.]pure ACK.[P.]data with ACK, the normal data segment.[F.]FIN with ACK, a graceful close.[R]or[R.]reset.[R.]in reply to a SYN means the port is closed.
Capturing only control segments
tcpdump -ni eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0'They will ask next
What are NULL, FIN and Xmas scans?
Port scans that send segments with no flags, only FIN, or FIN, PSH and URG together. RFC-compliant stacks answer a closed port with RST and stay silent for an open one, so silence hints that a port is open. Stacks that answer RST to everything defeat the trick. A stateful firewall drops these packets because they do not belong to any connection.
Is a SYN with data legal?
Yes. TCP Fast Open (RFC 7413) puts data in the SYN using a cookie from a previous connection, saving one round trip. The server only hands that data to the application if the cookie is valid.
Why does every segment after the SYN have ACK set?
Once a side knows the peer's initial sequence number there is always something valid to acknowledge. Setting ACK on every segment keeps the acknowledgment flowing at no cost.
Traps
- Saying PSH is required for data to be delivered. Receivers deliver data without it. It is a hint.
- Thinking a RST gets acknowledged. It does not; the receiver validates it and tears the connection down.