Learning Tcp flags

TCP标志详解：握手、确认与关闭

最新推荐文章于 2025-11-25 07:55:33 发布

转载最新推荐文章于 2025-11-25 07:55:33 发布 · 120 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：https://www.howtouselinux.com/post/tcpdump-capture-packets-with-tcp-flags

文章标签：

#linux #docker #ubuntu #服务器

TCP标志包括SYN、ACK、FIN等，它们在建立和终止连接中起关键作用。SYN用于初始化三次握手，ACK确认接收到的数据，FIN表示发送方不再有数据。URG标记紧急数据，PSH提示立即处理数据，RST用于重置连接，ECE和CWR处理拥塞控制，NS是实验性的安全特性。

What are TCP flags?

Each TCP flag corresponds to 1 bit in size. The list below describes each flag in greater detail. Additionally, check out the corresponding RFC section attributed to certain flags for a more comprehensive explanation.

SYN - The synchronisation flag is used as a first step in
establishing a three way handshake between two hosts. Only the first
packet from both the sender and receiver should have this flag set.
The following diagram illustrates a three way handshake process.
ACK - The acknowledgment flag is used to acknowledge the successful
receipt of a packet. As we can see from the diagram above, the
receiver sends an ACK as well as a SYN in the second step of the
three way handshake process to tell the sender that it received its
initial packet.
FIN - The finished flag means there is no more data from the sender.
Therefore, it is used in the last packet sent from the sender.
URG - The urgent flag is used to notify the receiver to process the urgent packets before processing all other packets. The receiver will be notified when all known urgent data has been received. See RFC 6093 for more details.
PSH - The push flag is somewhat similar to the URG flag and tells the receiver to process these packets as they are received instead of buffering them.
RST - The reset flag gets sent from the receiver to the sender when a packet is sent to a particular host that was not expecting it.
ECE - This flag is responsible for indicating if the TCP peer is ECN capable. See RFC 3168 for more details.
CWR - The congestion window reduced flag is used by the sending host to indicate it received a packet with the ECE flag set. See RFC 3168 for more details.
NS (experimental) - The nonce sum flag is still an experimental flag used to help protect against accidental malicious concealment of packets from the sender. See RFC 3540 for more details.