TCP Header Flag Utility

TCP Flags Calculator

Use this TCP Flags Calculator to combine TCP control flags into decimal, hexadecimal and binary values, or decode a numeric TCP flags field back into FIN, SYN, RST, PSH, ACK, URG, ECE, CWR and NS.

✓ SYN / ACK ✓ FIN / RST ✓ PSH / URG ✓ ECE / CWR ✓ 9-bit NS Support

FLAGS

Calculate / Decode TCP Flags

● Ready

NS Nonce Sum 0x100

CWR Congestion Window Reduced 0x80

ECE ECN Echo 0x40

URG Urgent Pointer Valid 0x20

ACK Acknowledgment Valid 0x10

PSH Push 0x08

RST Reset Connection 0x04

SYN Synchronize 0x02

FIN Finish 0x01

TCP Flags Value Enter a decimal, hexadecimal or binary flags value from 0 to 511.

Input Format

TCP flag field: FIN through CWR form the familiar low 8 control bits. NS is carried as the additional low-order control bit associated with the TCP header’s reserved / nonce-sum position, so this calculator shows a 9-bit combined value when NS is included.

TCP Flags Result Calculated

Active TCP Flags –

Decimal Value –

Hex Value –

Binary –

Active Flags –

8-Bit Flags Byte –

NS Bit –

Common Pattern –

Field Width –

Flag	Bit	Decimal	Hex	Status	Meaning

Bitwise Calculation Breakdown

What Is a TCP Flags Calculator?

A TCP Flags Calculator converts individual TCP control flags into their combined numeric value or performs the reverse operation. This is useful when reading packet captures, firewall logs, IDS rules, raw TCP headers and network debugging output.

Because each flag corresponds to one bit, multiple flags are combined using a bitwise OR operation.

TCP Flag Values

Flag	Decimal	Hex	Binary Bit	Purpose
FIN	1	0x01	000000001	Sender has finished sending data
SYN	2	0x02	000000010	Synchronize sequence numbers
RST	4	0x04	000000100	Reset the connection
PSH	8	0x08	000001000	Push buffered data to the application
ACK	16	0x10	000010000	Acknowledgment field is significant
URG	32	0x20	000100000	Urgent pointer is significant
ECE	64	0x40	001000000	ECN Echo
CWR	128	0x80	010000000	Congestion Window Reduced
NS	256	0x100	100000000	Nonce Sum flag

How TCP Flags Are Combined

Each TCP flag occupies a different bit position. To combine several flags, their values can be added because no two flags share the same bit.

SYN = 2
ACK = 16

SYN + ACK
= 2 + 16
= 18 decimal
= 0x12
= 000010010 binary

TCP SYN Flag

SYN has decimal value 2 and hexadecimal value 0x02. It is used during TCP connection establishment to synchronize sequence-number spaces.

SYN

Decimal: 2
Hex:     0x02
Binary:  000000010

SYN + ACK Value

A SYN-ACK segment commonly appears in the second step of the TCP three-way handshake.

SYN = 0x02
ACK = 0x10

0x02 | 0x10
= 0x12

Decimal:
18

Therefore a flags value of decimal 18 or hexadecimal 0x12 represents SYN + ACK.

TCP ACK Flag

ACK has decimal value 16 and hexadecimal value 0x10. When set, the acknowledgment-number field is meaningful.

ACK
= 16
= 0x10

PSH + ACK Value

PSH + ACK is a common combination during established TCP data transfer.

PSH = 8
ACK = 16

Total:
24 decimal

Hex:
0x18

FIN + ACK Value

FIN = 1
ACK = 16

FIN + ACK
= 17 decimal
= 0x11

This combination is commonly observed during an orderly TCP connection close.

RST + ACK Value

RST = 4
ACK = 16

RST + ACK
= 20 decimal
= 0x14

RST indicates connection reset rather than normal FIN-based termination.

TCP Three-Way Handshake Flags

Step 1 — SYN

Client normally initiates the connection with SYN, flags value 0x02.

Step 2 — SYN + ACK

The other endpoint responds with SYN+ACK, flags value 0x12.

Step 3 — ACK

The initiating endpoint acknowledges with ACK, flags value 0x10.

Established Traffic

ACK is commonly present on most later TCP segments.

TCP Flags Hex to Decimal

To convert a hexadecimal TCP flags value to decimal, interpret the flags field as an unsigned bit mask.

0x12

0x10 = ACK = 16
0x02 = SYN = 2

16 + 2
= 18

TCP Flags Decimal to Hex

Decimal:
24

16 = ACK
8  = PSH

24 decimal
= 0x18

Flags:
PSH + ACK

Understanding the TCP Flags Byte

The familiar low-order TCP control byte contains:

CWR ECE URG ACK PSH RST SYN FIN

Its value can range from 0x00 through 0xFF. For example:

0x12

00010010

ACK = 1
SYN = 1

What About the NS Flag?

NS is an additional TCP control bit associated with the low bit of the header’s reserved/nonce field rather than the ordinary eight-bit flags byte. For calculations that represent all nine named TCP control flags together, this page assigns NS the bit-mask value:

NS = 1 << 8
   = 256
   = 0x100

This is why the complete calculator accepts values through 511 (0x1FF).

Maximum TCP Flags Value

When all nine flags represented by this calculator are set:

NS  256
CWR 128
ECE  64
URG  32
ACK  16
PSH   8
RST   4
SYN   2
FIN   1

Total:
511

Hex:
0x1FF

Binary:
111111111

Common TCP Flag Combinations

Flags	Decimal	Hex	Typical Context
SYN	2	0x02	Connection request
SYN + ACK	18	0x12	Handshake response
ACK	16	0x10	Acknowledgment
PSH + ACK	24	0x18	Common data transfer
FIN + ACK	17	0x11	Orderly connection close
RST	4	0x04	Connection reset
RST + ACK	20	0x14	Reset with acknowledgment context

TCP Flags in Packet Captures

Packet analyzers may display TCP flags using names, letters, hexadecimal masks or decoded bit fields. A capture might show a value such as:

Flags: 0x012 (SYN, ACK)

The calculator helps verify that the hexadecimal and named representations agree.

TCP Flags in Firewall and IDS Logs

Firewalls, intrusion-detection systems and packet-processing tools often expose TCP flag masks numerically. Decoding those masks can help identify connection attempts, resets, FIN scans, unexpected flag combinations and established traffic patterns.

A flag combination alone does not prove malicious or legitimate behavior. Interpret flags together with sequence numbers, connection state, source and destination, timing and the surrounding packet flow.

TCP Flags Calculator FAQs

What is the TCP SYN flag value?

SYN is decimal 2 and hexadecimal 0x02.

What is the TCP ACK flag value?

ACK is decimal 16 and hexadecimal 0x10.

What is SYN ACK in decimal?

SYN + ACK equals 2 + 16 = 18 decimal.

What is SYN ACK in hexadecimal?

SYN + ACK equals hexadecimal 0x12.

What TCP flags are decimal 24?

24 decimal is 0x18, representing PSH + ACK.

What TCP flags are decimal 17?

17 decimal is 0x11, representing FIN + ACK.

What TCP flags are 0x14?

0x14 represents RST + ACK.

What is the FIN flag value?

FIN is decimal 1 and hexadecimal 0x01.

What is the RST flag value?

RST is decimal 4 and hexadecimal 0x04.

What is the PSH flag value?

PSH is decimal 8 and hexadecimal 0x08.

What is the URG flag value?

URG is decimal 32 and hexadecimal 0x20.

What is the ECE flag value?

ECE is decimal 64 and hexadecimal 0x40.

What is the CWR flag value?

CWR is decimal 128 and hexadecimal 0x80.

What is the NS TCP flag?

NS is the Nonce Sum control bit. When all nine named control bits are represented as one mask, this calculator uses decimal 256 or hexadecimal 0x100 for NS.

Why is SYN ACK 18?

SYN has value 2 and ACK has value 16. Their bits are combined, producing 2 + 16 = 18.

What are the flags in 0x12?

0x12 contains the ACK bit 0x10 and SYN bit 0x02.

What are the flags in 0x18?

0x18 contains PSH 0x08 and ACK 0x10.

Can multiple TCP flags be set at once?

Yes. TCP control flags are independent bits, so several can be active in the same TCP segment.

Calculate and Decode TCP Flag Masks

Select TCP flags to calculate their decimal, hexadecimal and binary mask, or enter a numeric value to identify exactly which SYN, ACK, FIN, RST, PSH, URG, ECE, CWR and NS bits are active.