TCP Flags Reference

All 9 TCP flags with meanings and when you see them in captures.

Flag	Meaning	When seen
NS	Nonce Sum, ECN concealment protection	Rarely; ECN nonce experiments.
CWR	Congestion Window Reduced, sender throttles	After congestion; sender confirms it throttled.
ECE	ECN Echo, network congestion signal	During congestion; receiver echoes ECN signal.
URG	Urgent pointer field significant	Legacy urgent/OOB data, e.g. Telnet interrupts.
ACK	Acknowledgment number valid	Almost every packet after the initial SYN.
PSH	Push data to application now	Interactive sends pushing buffered data up.
RST	Reset connection immediately	Refused port, aborted or half-open reset.
SYN	Synchronize sequence numbers, open	Connection open handshake (SYN, SYN-ACK).
FIN	Finish, no more data, close	Graceful close, each side in turn.

How to read the result

Flags live in the TCP header control bits. handshake = SYN, steady state = ACK/PSH, teardown = FIN, abort = RST, congestion = ECE/CWR.

SYN → SYN-ACK → ACK opens; FIN closes; RST aborts.

A packet with both SYN and ACK set: the server accepts the open request and syncs its own sequence number.

FIN is a graceful close (data delivered, each side finishes); RST aborts immediately, dropping state.