Urgent
TCP URG (Urgent, bit 2) signals that the Urgent Pointer field is valid and that the segment contains urgent data that should be prioritized. The Urgent Pointer indicates the byte offset of the end of the urgent data. This mechanism is rarely used in modern applications and has ambiguous semantics across implementations.
Abbreviation
URG
Bit Position
2
tcpdump
[U]
Standard
RFC 9293
Description
The URG flag enables TCP's out-of-band data mechanism. When URG is set, the Urgent Pointer field in the TCP header contains an offset relative to the sequence number that marks the end of urgent (high-priority) data. The receiver is expected to process this urgent data ahead of normal data in the receive buffer.
URG was designed for situations like sending an interrupt signal to a remote application (e.g., Telnet's Break signal) without waiting for buffered data to be consumed first. However, the semantics of urgent data are inconsistently implemented across operating systems, and RFC 6093 (2011) deprecated the TCP urgent mechanism for most uses.
In practice, URG is almost exclusively associated with legacy Telnet and FTP control connections. Modern applications use application-level out-of-band channels instead. Seeing URG in modern traffic (outside of Telnet/FTP) often indicates malformed or malicious packets.
Key Flag Combinations
| Flags | Meaning |
|---|---|
| URG+ACK | Urgent data with acknowledgment – normal urgent data segment |
| URG+PSH+ACK | Urgent data that should also be pushed to application immediately |
When You See This Flag
- –Telnet Break signal or interrupt sent over an active session
- –Legacy FTP control channel using TCP urgent data
- –Malformed packet from buggy legacy network stack