Parse a TCP Segment Manually

TCP Header Layout

TCP provides reliable, ordered byte streams. The minimum header is 20 bytes. For example, a SYN segment to port 443 might have source port 54321, destination port 443, sequence number 1000, and flags SYN+ACK encoded in byte 13.

Key Fields

• Ports (bytes 0-3): source and destination, e.g. 80 and 49152
• Sequence (bytes 4-7): byte offset in the sender's stream
• Acknowledgment (bytes 8-11): next expected byte from receiver
• Data offset (high nibble of byte 12): header length in 32-bit words
• Flags (byte 13): SYN, ACK, FIN, RST, PSH, URG
• Window (bytes 14-15): receive buffer space advertised

Common flag combinations:

• SYN only: connection initiation
• SYN+ACK: server response during handshake
• ACK only: established data transfer
• FIN+ACK: graceful close

Parsing Gotcha

The data-offset nibble determines where TCP options end and payload begins. Misreading it desyncs every byte after the header. A data offset of 5 means 20 bytes with no options; 6 means 24 bytes with 4 bytes of options.

Why This Exercise

This task asks you to parse a simulated TCP segment and print ports, sequence numbers, flags, and window size. nmap's SYN scan crafts and reads exactly these fields to fingerprint open ports without completing a handshake.