decoder.tools

TCP / UDP / ICMP Header Decoder

Decode transport-layer packet headers straight from hex bytes.

Network, System & PacketsFree
INPUT

Or drop a file here: a .bin dump of one packet

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

A TCP/UDP header decoder parses the fixed-format bytes at the start of a transport-layer packet into named fields — source and destination ports, sequence and acknowledgement numbers, flags, window size and checksum.

Example

Input
45000028d431400040066f11c0a8010a5db8d822c93a01bb000003e8000000005002faf0ee860000
Output
IPv4 192.168.1.10 → 93.184.216.34, TCP, TTL 64
Version: IPv4
Source: 192.168.1.10
Destination: 93.184.216.34
Protocol: 6 — TCP
TTL: 64
Total length: 40 bytes

What is the TCP / UDP / ICMP Header Decoder?

A TCP header is 20 bytes before options: two 16-bit ports, a 32-bit sequence number, a 32-bit acknowledgement number, a data offset and nine flag bits, then window size, checksum and urgent pointer. UDP is far simpler — 8 bytes of source port, destination port, length and checksum, with no state and no guarantees.

The flag bits are what you read first when debugging. SYN opens a connection, SYN+ACK accepts it, FIN closes it gracefully and RST tears it down abruptly. A capture full of RSTs points at a firewall or a service that isn't listening; repeated SYNs with no reply point at a dropped packet path rather than a refused one.

The window size explains throughput problems: a window shrinking toward zero means the receiver can't keep up, which no amount of bandwidth will fix. Reading these fields directly from hex is the fallback when you have a log excerpt or a hex dump but no capture file to open in Wireshark.

How to use the TCP / UDP / ICMP Header Decoder

  1. Paste the packet bytes as hex, starting at the transport header.
  2. Read the decoded ports, sequence numbers and flags.
  3. Check the flags and window size against the behaviour you're troubleshooting.

When to use it

  • Reading a packet hex dump from a log or a device that can't export a pcap.
  • Confirming which flags a firewall is sending when connections fail.
  • Teaching or learning the transport header layout field by field.

TCP / UDP / ICMP Header Decoder at a glance

TCP header20 bytes minimum, plus options
UDP header8 bytes exactly — ports, length, checksum
TCP flagsURG ACK PSH RST SYN FIN (plus ECE, CWR, NS)
Port field16 bits — 0 to 65535

Frequently asked questions

What do the TCP flags mean?

SYN starts a connection, ACK acknowledges data, FIN closes gracefully, RST aborts immediately, PSH asks for immediate delivery and URG marks urgent data. A handshake is SYN, SYN+ACK, ACK.

How long is a TCP header?

20 bytes without options, up to 60 with them. The data-offset field gives the actual length in 32-bit words, which is how you find where the payload starts.

Why does UDP have no sequence numbers?

Because it makes no delivery or ordering guarantees by design. Applications that need reliability over UDP — QUIC, for instance — implement it themselves in the payload.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown