staticdata.dev
Menu
Datasets About Contact

TCP Flags

The complete set of TCP control flags as defined by IETF standards. Each entry records the flag abbreviation, its bit position within the 9-bit flags field of the TCP header, and a concise description of its role in connection management, flow control, and congestion signalling. The dataset covers the six original flags from RFC 793, now RFC 9293 (URG, ACK, PSH, RST, SYN, FIN), plus the three ECN-related flags added by RFC 3168 and RFC 3540 (CWR, ECE, NS, whose bit is now AE from RFC 9768), making it suitable for packet analysis tools, network documentation, and protocol education.

v1.0.0 MIT 9 records Updated 2026-10-05 stable Source:  RFC 9293 — Transmission Control Protocol (TCP), IANA TCP Header Flags registry, RFC 3168 — The Addition of Explicit Congestion Notification (ECN) to IP, RFC 3540 — Robust Explicit Congestion Notification (ECN) Signaling with Nonces

Quick fetch

Stable URL. CORS-enabled. No auth.

bash 
curl https://staticdata.dev/v1/tcp-flags.json

Or use as a typed import: import { tcpFlags } from "https://staticdata.dev/v1/tcp-flags.ts"

Formats

  • JSON 2.0 KB

    /v1/tcp-flags.json

    Open

    min: 1.7 KB · /v1/tcp-flags.min.json

  • CSV 1.5 KB

    /v1/tcp-flags.csv

    Open
  • TypeScript 2.1 KB

    /v1/tcp-flags.ts

    export const tcpFlags

    type TcpFlag = (typeof tcpFlags)[number]

    Open

Schema

Each record in the dataset has the following shape.

Schema
Field Type Description Example
flag string Abbreviated flag name as used in TCP header documentation SYN
bit number Bit position within the 9-bit TCP flags field (0 = least significant) 1
description string Description of the flag's purpose and usage in the TCP protocol Synchronize — initiates a TCP connection and synchronizes sequence numbers between sender and receiver; used in the three-way handshake.

Preview

First 9 records.

Data preview
flagbitdescription
NS8Nonce Sum (historic) — the experimental ECN-nonce flag from RFC 3540, which RFC 8311 moved to Historic. IANA now assigns this bit to AE (Accurate ECN, RFC 9768), used by AccECN to feed back congestion-marking counts.
CWR7Congestion Window Reduced — set by the sender to indicate that it received a TCP segment with the ECE flag set and reduced its congestion window in response (RFC 3168).
ECE6ECN-Echo — when the SYN flag is also set it indicates ECN capability; otherwise it signals to the sender that network congestion has been detected (RFC 3168).
URG5Urgent — indicates that the Urgent Pointer field is significant and the segment contains urgent data that should be prioritized ahead of the normal data stream.
ACK4Acknowledgment — indicates that the Acknowledgment Number field is valid; set in all segments after the initial SYN to acknowledge received data.
PSH3Push — requests that buffered data be pushed to the receiving application immediately rather than waiting for the buffer to fill.
RST2Reset — abruptly terminates the connection, used to refuse a connection attempt or reset an existing connection due to an error condition.
SYN1Synchronize — initiates a TCP connection and synchronizes sequence numbers between sender and receiver; used in the three-way handshake.
FIN0Finish — indicates that the sender has finished sending data and wishes to terminate the connection gracefully; used in the four-way connection teardown.

Showing 9 of 9. View full data:  JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl 
curl -sSL https://staticdata.dev/v1/tcp-flags.json | jq '.[0]'
JavaScript 
import type { TcpFlag } from "https://staticdata.dev/v1/tcp-flags.ts";

const res = await fetch("https://staticdata.dev/v1/tcp-flags.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const tcpFlags: TcpFlag[] = await res.json();
console.log(tcpFlags[0]);
Python 
import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/tcp-flags.min.json") as r:
    tcpFlags = json.load(r)

print(tcpFlags[0])
Go 
package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/tcp-flags.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}
Rust 
use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/tcp-flags.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

The data is curated from IETF standards governing the Transmission Control Protocol. The six original flags — URG, ACK, PSH, RST, SYN, and FIN — were specified in RFC 793 in 1981 (now consolidated in RFC 9293, 2022) and form the foundation of TCP connection management. SYN and FIN drive the three-way handshake and four-way teardown respectively; ACK acknowledges received data; RST abruptly resets or refuses connections; PSH signals that buffered data should be delivered to the application immediately; and URG marks out-of-band urgent data.

Three additional flags occupy the upper bits of the flags field. CWR (Congestion Window Reduced) and ECE (ECN-Echo) were introduced by RFC 3168 to support Explicit Congestion Notification, allowing routers to signal network congestion to endpoints without dropping packets. NS (Nonce Sum) was added experimentally by RFC 3540 as a mechanism to protect against accidental or deliberate suppression of ECN markings; it saw little deployment and RFC 3540 was moved to Historic by RFC 8311 in 2018. As of October 2026 IANA assigns that bit to AE (Accurate ECN, RFC 9768); the record keeps the NS identifier for compatibility and its description explains the reassignment. The three bits above it are reserved.

Bit positions are numbered from 0 (least significant, FIN) through 8 (most significant, NS), reflecting the order of bits within the 9-bit control field of the TCP header as laid out in protocol diagrams. This dataset is intended for use in network packet analyzers, protocol documentation tools, educational materials, and any application that needs a canonical, machine-readable reference for TCP flag semantics.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the tcp-flags changelog for this dataset's history.

More Web datasets