01
Use the prefix to choose the base
Bare 10 means decimal ten; 0b10 means binary two. Hexadecimal letters require 0x, and leading zeros never select octal.
- Uppercase prefixes work too; 0X0012 and 18 produce the same result.
IP & Subnet Tools
TCP flag decoder
Enter a decimal value, 0x hex or 0b binary. Toggle the eight low control bits to build a different mask.
TCP flag decoder
Numeric flags input
Edit the eight bits
Bit edits write 0xHH. Correct invalid or empty input before using the checkboxes.
Decoded flags
- Decimal
- 18
- Hexadecimal
- 0x12
- Binary
- 00010010
Combination and context
SYN + ACK
0x02 | 0x10 = 0x12
SYN + ACK: commonly a handshake response.
- 0 · CWR · 128 — Not set. Congestion-window reduction or ECN negotiation.
- 0 · ECE · 64 — Not set. ECN echo or negotiation, depending on context.
- 0 · URG · 32 — Not set. Urgent pointer field is significant.
- 1 · ACK · 16 — Set. Acknowledgment number field is significant.
- 0 · PSH · 8 — Not set. Push function.
- 0 · RST · 4 — Not set. Reset indication.
- 1 · SYN · 2 — Set. Synchronize sequence numbers.
- 0 · FIN · 1 — Not set. Sender has no more data to send.
Values stay in this browser. No packet capture, upload or network probe is performed.
Input rules
No prefix: decimal. Use 0x for hex or 0b for binary. Maximum 64 characters.
Low eight bits only: 0–255. AE (historically NS) is outside this field.
Patterns are common contexts, not connection states. ECE/CWR explanations assume conventional ECN.
Set bits: 2; decimal value: 18.
A TCP flag decoder is useful when a packet viewer gives you 0x12 while a log stores 18. Both represent the same two bits; neither is an acknowledgment number.
Check which field the value came from before interpreting it. Some flow logs combine flags from several packets, so their mask need not describe a single segment.
Why use a TCP flag decoder?
Keep the numeric field and its individual weights in view.
See exactly which bits contribute
The TCP flag decoder links one numeric field to eight editable checkboxes. Starting at 0x12, turn off SYN and the input becomes 0x10: ACK remains selected, so the change is easy to verify.
Combine independent weights
Start from zero and select the flags you need. SYN contributes 2 and ACK contributes 16; OR combines them into 18. The second diagram shows how separate set bits occupy their own positions in one mask.
Three details to check before exporting
02
Watch edits invalidate the result
Turning a checkbox changes the input to two-digit hexadecimal. Auto mode waits 350 ms before refreshing; manual mode reveals the decode button.
- Ctrl/Cmd + Enter runs the current value. Copy and download stay disabled until the changed input has been decoded.
03
Keep the observation context
The report includes all eight flags, even the unset ones, plus their weights and the OR expression. Compare those fields with the original log format.
- A familiar SYN + ACK pattern is a description of bits, not proof that a connection succeeded.
Control bits and numeric forms explained
Three bases, one unsigned value
This TCP flags calculator accepts decimal, hexadecimal and prefixed binary. Results always show two hex digits and eight binary digits, including leading zeros. TCP flags numbers are interpreted as a mask, not as a byte offset or a port.
Eight independent weights
TCP flag values run from FIN=1 to CWR=128. The enabled weights combine with bitwise OR. The full list shows both set and unset bits; it never hides a flag merely because its value is zero.
Common patterns and unusual pairs
Six examples cover SYN, SYN+ACK, ACK, PSH+ACK, FIN+ACK and RST+ACK. SYN with FIN or RST remains decodable and receives a context note; arbitrary masks are preserved rather than “corrected”.
Field width and interpretation limits
- Low eight bits only
- The accepted range is 0–255. AE, historically NS, lies outside this byte. Values such as 0x100 or 0x1FF are rejected, never reduced modulo 256. This is not a decoder for every bit in the TCP header.
- One strict numeric field
- Enter at most 64 characters including surrounding whitespace. Negative values, fractions, scientific notation, flag names, tcpdump letters, expressions and multiple numbers are rejected. Use checkboxes for named flags.
- No session verdict
- The tool does not capture packets, read PCAP files, probe ports or reconstruct connections. A mask alone cannot reveal the direction, sequence numbers, payload length or whether all handshake packets were observed.
- ECN needs more context
- ECE and CWR are shown with their conventional ECN meanings. Negotiated AccECN can give these bits a different combined interpretation; this eight-bit view does not decode that negotiation or diagnose congestion.
- Review replacements
- Loading an example or clearing input opens a preview with input and set-bit counts. Applying it invalidates the old output; one undo restores the previous input and output state. Direct typing and checkbox edits change the input immediately.
TCP flag decoder questions
Which flags are in 0x12?
Hexadecimal 0x12 is decimal 18: SYN contributes 2 and ACK contributes 16. This combination commonly appears in a handshake response. The tool displays that context without claiming that the handshake completed.
What does TCP flags 2 mean?
Decimal 2 sets SYN only. SYN synchronizes sequence numbers. It does not tell you the initial sequence number itself; that is another field in the segment.
How should TCP flags in VPC Flow Logs be read?
A flow-log value may be the OR of flags seen during an aggregation interval, and the provider may omit some flags. Decode the mask as recorded, then consult that log format; do not treat it as proof that all flags appeared in one packet.
Can I paste tcpdump flag letters?
No. Text such as [S.] is a display convention, not a number. For SYN+ACK use 18, 0x12 or the two checkboxes. This page does not parse tcpdump output or generate capture filters.
Can multiple TCP flags be set at once?
Yes. Each flag occupies its own bit, so SYN and ACK can coexist as 2 | 16 = 18. Some combinations need packet context, but the calculator still shows every bit accurately instead of rejecting an unusual combination.
Still have a question?
Return to the eight-bit field
Use the TCP flag decoder to check the mask, review the individual weights and keep the JSON record with your investigation notes.