thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Networking Fundamentals · Intermediate

TCP Flags

Single-bit control fields in the TCP header (SYN, ACK, FIN, RST, PSH, URG, ECE, CWR) that signal connection state and handling.

Definition

SYN starts a connection, ACK confirms received data, FIN closes gracefully, RST aborts, PSH tells the receiver to deliver data to the application promptly, and URG marks the urgent pointer as valid. ECE and CWR support Explicit Congestion Notification. Firewalls and scanners make heavy use of flag combinations.

Example

An Nmap SYN scan sends SYN and watches for SYN-ACK (open) or RST (closed).

Exam tip

Know which flag answers what: open port returns SYN-ACK, closed port returns RST.

Related terms