TCP Flags

TCP uses 8 control flags in the header to manage connection state, flow control, and congestion notification. SYN+ACK establishes connections, FIN closes them gracefully, RST aborts them. Flags are visible in tcpdump and Wireshark output on every TCP segment.

Flags

Bit	Flag	Full Name & Description	tcpdump
7	FIN	Finish TCP FIN (Finish, bit 7) signals that the sender has finished sending data.	[F]
6	SYN	Synchronize TCP SYN (Synchronize, bit 6) initiates a TCP connection.	[S]
5	RST	Reset TCP RST (Reset, bit 5) abruptly terminates a TCP connection.	[R]
4	PSH	Push TCP PSH (Push, bit 4) tells the receiver to push the data in this segment to the application immediately rather than waiting to fill a larger buffer.	[P]
3	ACK	Acknowledgment TCP ACK (Acknowledgment, bit 3) indicates the Acknowledgment Number field is valid.	[.]
2	URG	Urgent TCP URG (Urgent, bit 2) signals that the Urgent Pointer field is valid and that the segment contains urgent data that should be prioritized.	[U]
1	ECE	ECN-Echo TCP ECE (ECN-Echo, bit 1) has two distinct meanings depending on context.	[E]
0	CWR	Congestion Window Reduced TCP CWR (Congestion Window Reduced, bit 0) is set by a sender to acknowledge that it received an ECE flag and has reduced its congestion window.	[W]