What do the TCP flags mean?

SYN starts a connection, ACK acknowledges data, FIN closes gracefully, RST aborts immediately, PSH asks for immediate delivery and URG marks urgent data. A handshake is SYN, SYN+ACK, ACK.

How long is a TCP header?

20 bytes without options, up to 60 with them. The data-offset field gives the actual length in 32-bit words, which is how you find where the payload starts.

Why does UDP have no sequence numbers?

Because it makes no delivery or ordering guarantees by design. Applications that need reliability over UDP — QUIC, for instance — implement it themselves in the payload.

TCP / UDP / ICMP Header Decoder

Decode transport-layer packet headers straight from hex bytes.

on the roadmapNetwork, System & Packetsfree · no sign-up

This bench is being wired up

The tcp-udp-header-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the TCP / UDP / ICMP Header Decoder?

A TCP/UDP header decoder parses the fixed-format bytes at the start of a transport-layer packet into named fields — source and destination ports, sequence and acknowledgement numbers, flags, window size and checksum.

A TCP header is 20 bytes before options: two 16-bit ports, a 32-bit sequence number, a 32-bit acknowledgement number, a data offset and nine flag bits, then window size, checksum and urgent pointer. UDP is far simpler — 8 bytes of source port, destination port, length and checksum, with no state and no guarantees.

The flag bits are what you read first when debugging. SYN opens a connection, SYN+ACK accepts it, FIN closes it gracefully and RST tears it down abruptly. A capture full of RSTs points at a firewall or a service that isn't listening; repeated SYNs with no reply point at a dropped packet path rather than a refused one.

The window size explains throughput problems: a window shrinking toward zero means the receiver can't keep up, which no amount of bandwidth will fix. Reading these fields directly from hex is the fallback when you have a log excerpt or a hex dump but no capture file to open in Wireshark.

TCP / UDP / ICMP Header Decoder at a glance

TCP header: 20 bytes minimum, plus options
UDP header: 8 bytes exactly — ports, length, checksum
TCP flags: URG ACK PSH RST SYN FIN (plus ECE, CWR, NS)
Port field: 16 bits — 0 to 65535

How to use the TCP / UDP / ICMP Header Decoder

1Paste the packet bytes as hex, starting at the transport header.
2Read the decoded ports, sequence numbers and flags.
3Check the flags and window size against the behaviour you're troubleshooting.

When you would reach for it

Reading a packet hex dump from a log or a device that can't export a pcap.
Confirming which flags a firewall is sending when connections fail.
Teaching or learning the transport header layout field by field.

TCP / UDP / ICMP Header Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools