Analizar TCP segment headers
TCP headers contain source/destination ports, sequence números, flags, y window tamaño. Aprender a decodificar TCP headers para network análisis.
- 1
A TCP header is 20-60 bytes. Fields: source port (2 bytes), dest port (2 bytes), sequence number (4), acknowledgment number (4), data offset + flags (2), window size (2), checksum (2), urgent pointer (2), options (0-40). Flags: SYN, ACK, FIN, RST, PSH, URG, ECE, CWR.
- 2 Decodificador hexadecimal →
Decodificar the hex representation of a TCP header. The first 4 bytes are source and destination ports. For example, 0x0050 is port 80 (HTTP). Decode each field according to its offset and size.
- 3 Decodificador binario →
Decodificar the flags byte in binary. Each bit represents a flag: FIN (0x01), SYN (0x02), RST (0x04), PSH (0x08), ACK (0x10), URG (0x20). SYN+ACK = 0x12 = 00010010 in binary. This reveals the connection state.
Preguntas frecuentes
- What do the TCP flags mean?
- SYN: synchronize sequence numbers (connection start). ACK: acknowledgment number is valid. FIN: finish (graceful close). RST: reset (abort connection). PSH: push data immediately. URG: urgent pointer is valid. The combination of flags indicates the connection phase (SYN, SYN-ACK, ACK for handshake).
- What is the TCP window size?
- It indicates how many bytes the receiver can accept without acknowledgment — flow control. A larger window means higher throughput (less waiting for ACKs). Window scaling (RFC 7323) allows windows larger than 65535 by using a scale factor in the options.