Which bit represents which TCP flag?

Question

For instance, a WireShark capture filter example I found - tcp[13] & 8 == 8 represents packets with PSH flags.

How do I count the 8 ?

Based on the wikipedia image, enter image description here

PSH is in the middle of the TCP flags segment. Counting 1 from the NS flag, PSH bit representation should be 6 ?

Any guidance is appreciated.

score 0 · Answer 1 · answered Mar 26 '13 at 17:01

0

Time to read up on binary arithmetic! To grab the Nth rightmost bit from a byte, you do byte & (1 << N), so the rightmost bit is byte & (n << 0) and the 4th from the right is byte & (n << 3), which is the same as byte << 8.

answered Mar 26 '13 at 17:01

Dennis Kaarsemaker

19,277
2
44
70

Oh the 8 is in terms of binary ? Thanks for the info :) – iridescent Mar 27 '13 at 01:49

score 0 · Answer 2 · answered Mar 26 '13 at 17:03

0

You're also starting to count from the wrong place. NS may be the first flag, but it's also the end bit of byte 12. Byte 13 (as in tcp[13]) starts at bit 8 of line four (labelled "octet 12"), and runs to bit 15 on the same line.

answered Mar 26 '13 at 17:03

MadHatter

79,770
20
184
232

score 0 · Accepted Answer · answered Mar 26 '13 at 17:34

0

You should look at tcpdump man page, "Capturing TCP packets with particular flag combinations" section - it's a lots of details here.

answered Mar 26 '13 at 17:34

dsznajder

547
4
13

Which bit represents which TCP flag?

3 Answers3