# TCP / UDP / ICMP Header Decoder

> Decode transport-layer packet headers straight from hex bytes.

- Page: https://decoder.tools/tcp-udp-header-decoder
- Category: Network, System & Packets
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A TCP/UDP header decoder parses the fixed-format bytes at the start of a transport-layer packet into named fields — source and destination ports, sequence and acknowledgement numbers, flags, window size and checksum.

## Example

```text Input
45000028d431400040066f11c0a8010a5db8d822c93a01bb000003e8000000005002faf0ee860000
```

```text Output
IPv4 192.168.1.10 → 93.184.216.34, TCP, TTL 64
Version: IPv4
Source: 192.168.1.10
Destination: 93.184.216.34
Protocol: 6 — TCP
TTL: 64
Total length: 40 bytes
```

## What is the TCP / UDP / ICMP Header Decoder?

A TCP header is 20 bytes before options: two 16-bit ports, a 32-bit sequence number, a 32-bit acknowledgement number, a data offset and nine flag bits, then window size, checksum and urgent pointer. UDP is far simpler — 8 bytes of source port, destination port, length and checksum, with no state and no guarantees.

The flag bits are what you read first when debugging. SYN opens a connection, SYN+ACK accepts it, FIN closes it gracefully and RST tears it down abruptly. A capture full of RSTs points at a firewall or a service that isn't listening; repeated SYNs with no reply point at a dropped packet path rather than a refused one.

The window size explains throughput problems: a window shrinking toward zero means the receiver can't keep up, which no amount of bandwidth will fix. Reading these fields directly from hex is the fallback when you have a log excerpt or a hex dump but no capture file to open in Wireshark.

## How to use the TCP / UDP / ICMP Header Decoder

1. Paste the packet bytes as hex, starting at the transport header.
2. Read the decoded ports, sequence numbers and flags.
3. Check the flags and window size against the behaviour you're troubleshooting.

## When to use it

- Reading a packet hex dump from a log or a device that can't export a pcap.
- Confirming which flags a firewall is sending when connections fail.
- Teaching or learning the transport header layout field by field.

## TCP / UDP / ICMP Header Decoder at a glance

| | |
|---|---|
| TCP header | 20 bytes minimum, plus options |
| UDP header | 8 bytes exactly — ports, length, checksum |
| TCP flags | URG ACK PSH RST SYN FIN (plus ECE, CWR, NS) |
| Port field | 16 bits — 0 to 65535 |

## FAQ

### What do the TCP flags mean?

SYN starts a connection, ACK acknowledges data, FIN closes gracefully, RST aborts immediately, PSH asks for immediate delivery and URG marks urgent data. A handshake is SYN, SYN+ACK, ACK.

### How long is a TCP header?

20 bytes without options, up to 60 with them. The data-offset field gives the actual length in 32-bit words, which is how you find where the payload starts.

### Why does UDP have no sequence numbers?

Because it makes no delivery or ordering guarantees by design. Applications that need reliability over UDP — QUIC, for instance — implement it themselves in the payload.