ForHosting KIT · Developer Utilities

TCP flags decoder

0x12, or 18, is SYN plus ACK, not a lone SYN: type a flags byte in decimal, hex or binary to see every control bit by name, or list names such as SYN and ACK to get the byte back. Free in your browser.

Free
Runs in your browser
No sign-up
Your data stays on your device

Run — free How it works & API

Use it from WebAPIEmailTelegramApp soon

Worked example

If you enter

Value: 0x12
Calculation mode: Decode

You get

Value decimal: 18
Value hex: 0x12
Value binary: 0b00010010
Flags: SYN, ACK

A TCP segment carries a compact flags octet that decides whether the packet is opening a handshake, acknowledging data, pushing a buffer, resetting a socket, or marking congestion. Packet captures, Wireshark columns, and socket traces usually show that byte as hex, while textbooks and firewall rules talk about named bits such as SYN, ACK, FIN, RST, PSH, and URG. Translating between those two views by hand is where off-by-one mistakes hide: a SYN-ACK is 0x12, not 0x03, and ACK is bit 4, not bit 0. This TCP flags decoder accepts a flags byte in decimal, 0x-hex, or 0b-binary and returns every named control bit, or it accepts a set of names and encodes them back into the same byte.

What the TCP flags byte means and which bits this decoder names

The thirteenth octet of a TCP header is the control-bits field. RFC 793 defined six flags in the low bits: FIN (0x01) closes the sending half of the connection, SYN (0x02) synchronizes sequence numbers at the start of a handshake, RST (0x04) aborts a socket, PSH (0x08) asks the receiver to deliver buffered data promptly, ACK (0x10) marks a valid acknowledgment number, and URG (0x20) marks urgent pointer data.

RFC 3168 later spent the two high bits on explicit congestion notification: ECE (0x40) echoes a congestion experienced mark, and CWR (0x80) says the sender reduced its congestion window. Together those eight masks fill the flags byte completely, so a value from 0 through 255 is a lossless encoding of the set. Classic three-way handshake traffic is easy to recognize once the bits are named: a lone SYN is 0x02, the SYN-ACK reply is 0x12, and the final ACK is 0x10.

A tidy close is often FIN plus ACK (0x11); an abort is RST, sometimes with ACK. This decoder lists set bits in RFC bit order from FIN through CWR, emits hex and eight-bit binary, and also prints tcpdump-style letters where ACK is a period, so S. is the familiar SYN-ACK glyph. The NS nonce from RFC 3540 lives in the reserved nibble of the previous byte, not in this octet, and is therefore out of scope.

What you can do with it

Read a SYN-ACK from a hex dump

Paste 0x12 or 18 to confirm the segment is SYN plus ACK, not a lone SYN, before you explain a three-way handshake or a refused connection.

Build a firewall or BPF flag mask

Encode names such as SYN, ACK, or RST into the exact byte you place beside a mask in a filter, then decode hits to prove the rule saw the bits you intended.

Annotate capture pipelines and quizzes

Turn stored flags integers into ordered names and tcpdump letters for dashboards, tickets, and exam items without shipping a full packet dissector.

FAQ

How do I decode a TCP flags byte into SYN, ACK, and the other bits?

Set mode to decode and send value as decimal 0–255, 0x-hex, or 0b-binary. The response lists every set name in RFC order, plus hex, binary, booleans, and a tcpdump glyph.

How do I encode SYN and ACK back into a flags byte?

The encoder ORs the bit masks; SYN plus ACK is 0x12 (decimal 18).

Which TCP flags are supported?

The eight bits of the flags octet: FIN 0x01, SYN 0x02, RST 0x04, PSH 0x08, ACK 0x10, URG 0x20, ECE 0x40, and CWR 0x80. The NS nonce bit is not part of this byte.

What does the tcpdump field mean?

It is the compact letter string tcpdump prints for the same bits: FIN is F, SYN is S, RST is R, PSH is P, ACK is a period, URG is U, ECE is E, and CWR is W. SYN-ACK therefore appears as S followed by a period.

Which flag values does a TCP three-way handshake use?

A lone SYN is 0x02, the SYN-ACK reply is 0x12 and the final ACK is 0x10. A tidy close is often FIN plus ACK, 0x11, while an aborted connection shows RST, sometimes together with ACK.

Related tools

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/dev/tcp-flags-decode

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/dev/tcp-flags-decode \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"mode":"decode"}'

const res = await fetch("https://api.kit.forhosting.com/dev/tcp-flags-decode", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "mode": "decode"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/dev/tcp-flags-decode",
    headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
    json={
    "mode": "decode"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/tcp-flags-decode", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => '{"mode":"decode"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"mode":"decode"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/tcp-flags-decode", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "mode": "decode"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "dev.tcp_flags_decode",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Technical notes

Input contract, decode versus encode, and the response shape

Set mode to decode or encode. Matching is case-insensitive; spaces, pipes, and semicolons are also accepted as separators; duplicate names are ignored because bitwise OR is idempotent. An empty flags array encodes the zero byte, which is unusual on the wire but legal as a mask. Optional keys are omitted rather than set to null. Failed validation is not billed. In decode mode, value is required and may be a JSON number or a string: decimal 18, hexadecimal 0x12, or binary 0b00010010 all mean the same SYN-ACK byte. Integers outside 0 through 255, non-integer numbers, empty strings, and unprefixed junk fail with invalid_input naming value. In encode mode, flags is required and may be a comma-separated string such as SYN,ACK or a JSON array of the same names. Unknown tokens, including NS or invented nicknames, fail with invalid_input that lists the eight legal names. On success the body always includes mode, value_decimal, value_hex (two lowercase digits), value_binary (eight bits), flags as an ordered array, flags_string as the same names joined by commas, tcpdump letters, eight boolean fields named fin through cwr, and a formula string that restates the bit weights. Example: decode 0x12 yields flags SYN and ACK, tcpdump S., and value_decimal 18; encode SYN,ACK yields the identical byte so the two modes are exact inverses.

Where a TCP flags decoder earns its keep

Protocol labs and interview drills still ask students to read a hex dump and say whether a segment is a SYN, a SYN-ACK, or a stray RST; a shared decoder is the oracle that marks those answers without arguing about bit numbering. Firewall and BPF authors encode a set of names into the byte they put next to a mask, then decode production hits to confirm the rule matched SYN and not SYN-ACK. Pin the hex, the ordered flags array, and the tcpdump glyph in tests, and you get reproducible handshake math for edge workers, packet quizzes, and socket traces without standing up a full dissectors stack just to name eight bits. Capture pipelines that already store the TCP flags octet as an integer can call this endpoint to attach human names before a ticket or a dashboard cell is shown to an on-call engineer.

Technical questions

What does the TCP flags decoder cost?

The browser tool is free. API requests use prepaid KIT balance at $0.002 per successful call; invalid input is not billed.

Read the full KIT documentation →

Run — free