BYTETOOLS

TCP Header Decoder

Decode a TCP header hex dump: ports, sequence and ack numbers, all nine flag bits, window size, and every option including MSS, SACK and timestamps.

SYN
Flags set
40 B
Header length
5
Options
0 B
Payload supplied

Header fields

FieldRawMeaning
Source port0xc9ac51,628
Destination port0x005080
Sequence number0xb3a1c0d43,013,722,324
Acknowledgement number0x000000000 (ACK flag clear — ignore this field)
Data offset0xa10 words × 4 = 40 bytes
Flags0b000000010SYN
Window size0xfaf064,240 bytes (before window scaling)
Checksum0xf4a9covers the pseudo-header, header and payload
Urgent pointer0x00000 (URG flag clear — ignore this field)

Control flags

NS = 0ECN nonce sum (RFC 3540; reclassified as reserved by RFC 8311)
CWR = 0congestion window reduced — the sender responded to an ECE
ECE = 0ECN echo — congestion was signalled, or ECN is being negotiated on a SYN
URG = 0the urgent pointer field is meaningful
ACK = 0the acknowledgement number field is meaningful
PSH = 0push buffered data to the receiving application immediately
RST = 0reset the connection
SYN = 1synchronise sequence numbers — the first packet of a handshake
FIN = 0no more data from the sender

TCP options

KindOptionLenDecodedRaw
2Maximum segment size4MSS = 1,460 bytes020405b4
4SACK permitted2the sender accepts selective acknowledgements0402
8Timestamps10TSval 255,597,100, TSecr 0080a0f3c1a2c00000000
1No operation (NOP)1one byte of padding, used to align the next option01
3Window scale3shift count 7 → window multiplier ×128030307

Header bytes

c9ac0050b3a1c0d400000000a002faf0f4a90000020405b40402080a0f3c1a2c0000000001030307

The TCP checksum cannot be verified from the header alone — it also covers the IP pseudo-header (source and destination addresses, protocol number and TCP length) plus the segment payload, so those bytes have to be supplied too.

What is the TCP Header Decoder?

The TCP Header Decoder parses a hex dump of a TCP header into named fields: source and destination ports, the 32-bit sequence and acknowledgement numbers, the data offset and the header length it implies, all nine control flags, the window size, the checksum and the urgent pointer.

  • All nine control flags shown as a grid with what each one means
  • Sequence and acknowledgement numbers read as true 32-bit unsigned values
  • Full TLV option walk — MSS, window scale, SACK permitted, SACK blocks, timestamps, NOP and EOL
  • Flags the ACK and URG fields as meaningless when their flag bits are clear
  • Detects malformed option lengths instead of running off the end of the header
  • Accepts spaced hex, continuous hex, 0x-prefixed bytes and Wireshark offset columns

How to use the TCP Header Decoder

  1. 1

    Copy the TCP header bytes from your capture — at least 20, or the full header if options are present.

  2. 2

    Paste them into the hex dump box; spaces, newlines and offset columns are handled.

  3. 3

    Read the field table and the flag grid, which highlights every bit that is set.

  4. 4

    Check the options table for MSS, window scale, SACK and timestamp values, then copy the summary.

About the TCP Header Decoder

The TCP Header Decoder parses a hex dump of a TCP header into named fields: source and destination ports, the 32-bit sequence and acknowledgement numbers, the data offset and the header length it implies, all nine control flags, the window size, the checksum and the urgent pointer.

Where it earns its keep is the options. Anything past the fixed 20 bytes is walked as a TLV list and decoded properly — maximum segment size, window scale with its shift count and multiplier, SACK-permitted, SACK blocks with their left and right edges, timestamps with TSval and TSecr, plus NOP padding and end-of-list markers.

It is built for reading captures, debugging handshakes and studying for exams. Paste from Wireshark, tcpdump or a hex editor; everything is decoded 100% locally in your browser and no capture data is uploaded.

Frequently asked questions

How do I decode a TCP header from hex?

The first two bytes are the source port and the next two the destination. Bytes 4–7 are the sequence number, 8–11 the acknowledgement number, and the high nibble of byte 12 is the data offset in 32-bit words. Paste the bytes here and every field is labelled for you.

What are the nine TCP flags?

NS, CWR, ECE, URG, ACK, PSH, RST, SYN and FIN. The first three relate to explicit congestion notification; URG marks the urgent pointer as valid, ACK marks the acknowledgement number as valid, PSH asks for immediate delivery, and RST, SYN and FIN control connection state.

What does the TCP window scale option do?

It carries a shift count, exchanged once in the SYN, that multiplies the 16-bit window field by 2 raised to that count. A shift of 7 multiplies the advertised window by 128, which is what lets modern TCP fill high-latency gigabit paths.

How do I read SACK blocks?

Each block is two 32-bit sequence numbers — the left edge (first byte received) and the right edge (one past the last). They tell the sender which out-of-order ranges arrived safely so it retransmits only the genuine holes rather than everything after the loss.

Can this tool verify the TCP checksum?

No, and no tool can from the header alone. The TCP checksum also covers a pseudo-header built from the IP source and destination addresses, the protocol number and the TCP length, plus the entire segment payload — so those bytes have to be supplied as well.

Related tools