b2KIT

TCP Flag Calculator

Calculate TCP flag values (SYN, ACK, FIN, RST, PSH, URG) from decimal, hex, or binary. Visualize flag combinations.

Tested tool guide Tested browser tools Checked August 16, 2026

What TCP Flag Calculator does, with a checked example

Six bits in every TCP header decide whether a packet opens a connection, acknowledges data, or tears it down. This tool takes a TCP flags value in decimal, hex, or binary and returns the other two notations plus the set of flags it encodes - SYN, ACK, FIN, RST, PSH, URG - shown as a labeled bit pattern. The thing people get wrong most often: the flags are numbered from the least significant bit, so SYN is 2 and FIN is 1, and SYN+ACK is 0x12 (18), not 0x03.

Worked example

A concrete input and expected output from the current implementation.

Input

0x12

Expected output

Decimal 18, hex 0x12, binary 00010010. Flags set: SYN + ACK. Six-bit field (URG ACK PSH RST SYN FIN): 0 1 0 0 1 0.

ACK has weight 16 (bit 4) and SYN weight 2 (bit 1), so the two sum to 18, which is 0x12. The conversion checks out in both directions: the number decodes to exactly those two flags, and adding the two weights reproduces the number.

How the result is produced

1

Bit weights

The six control flags occupy the low six bits of the TCP flags field. Reading from the least significant bit upward the weights are FIN=1, SYN=2, RST=4, PSH=8, ACK=16, URG=32. Any combination equals the sum of its set flags, so one number represents the whole set; the tool splits an entered value into these weights, lists the flags, and converts the value between the three bases.

2

Flag visualization

The result view lays the value out as a fixed-width binary pattern with the six flag labels URG, ACK, PSH, RST, SYN, FIN over the bit positions, set bits highlighted. A value like 0x1B (27) reads at a glance as FIN+SYN+PSH+ACK: bits 0, 1, 3, and 4 set, URG absent. This is the check that catches hand-added sums before they reach a filter or a socket.

Good uses

  • A capture shows Flags [S.] in tcpdump or Wireshark; convert that combination to the number you need for a filter or rule such as tcp[13] & 0x12 != 0.
  • A firewall log or alert prints a raw flags number; decode decimal 20 or hex 0x14 and see it is RST+ACK before judging the event.
  • You are crafting packets with Scapy, raw sockets, or netfilter and want to confirm a hand-computed sum, for instance that 50 really is SYN+ACK+URG.

Limits and checks

  • The six labels run URG ACK PSH RST SYN FIN from most to least significant bit, so ACK is not 2 and SYN is not 1. The value 0x03 is FIN+SYN; 0x12 is SYN+ACK - swapping those two is the classic misread.
  • A bare 12 is decimal, which is 0x0C (PSH+RST), while 0x12 is SYN+ACK. Before converting a value from a log or capture, note the notation it was printed in, and include the 0x or 0b prefix when you enter it so the base is unambiguous.
  • The real header packs the data offset, reserved bits, and nine flag bits (NS, CWR, ECE sit above URG) into one word. This tool models the six classic flags only, so feed it the flags byte or a value below 64 - a full 16-bit word will not decode the way Wireshark shows it.

Common questions

Why is SYN+ACK 18 (0x12) instead of 3 (0x03)?

The six flags are numbered from the least significant bit, not by prominence or alphabetically: FIN=1, SYN=2, RST=4, PSH=8, ACK=16, URG=32. ACK carries weight 16 and SYN weight 2, so the pair sums to 18. The value 3 is FIN+SYN, a combination associated with connection teardown, not the handshake.

Does it handle the ECN flags, ECE and CWR?

No. This tool covers the six classic control flags, and the ECN bits sit above URG in the real header: ECE=64, CWR=128, NS=256. A capture value like 0x52, which Wireshark renders as SYN+ECE+ACK, is outside this six-flag model, so keep inputs below 64 or account for the ECN bit yourself.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools