Why does the parser keep the window unscaled?

Window scaling depends on connection negotiation. A captured segment alone does not establish the peer's scale factor.

What does Data offset measure?

It counts four-byte words in the TCP header. Multiply it by four to locate the first payload byte.

Can one segment prove a connection succeeded?

No. The parser reads individual segment fields. It does not reconstruct handshakes, retransmissions, or connection state.

TCP Parser | Tool Factory

Tool workspace

Packet bytes stay in this browser. Checksum checks use only the addresses you enter.

Needs input

Run the tool when your input is ready.

Packet bytes

Paste one complete TCP segment, starting with its source port. Remove Ethernet and IP headers.

Options

Input format

Source IP

Optional checksum context. Enter the source IPv4 or IPv6 address from the packet.

Destination IP

Enter the final destination address. Both addresses must use the same IP version.

Your result appears here

Parse TCP ports, unsigned sequence numbers, flags, options, and payload. Inspect byte offsets and verify checksums with IP context.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

TCP Parser reads one complete segment with its ports, sequence numbers, flags, window, checksum, urgent pointer, and options. Sequence and acknowledgement numbers remain unsigned. The data offset selects the header boundary in four-byte units. Supply both IP addresses to verify the checksum over the complete segment and IP pseudo-header.

The JSON keeps options in wire order. The byte table explains every header field, option boundary, and payload offset.

Check an unsigned sequence number near the 32-bit boundary.
Inspect repeated TCP options without merging their records.
Locate malformed option lengths before interpreting application data.

Sources: RFC 9293: TCP header and option rules; RFC 7323: window scaling and timestamps

Instructions

Paste the TCP segment after removing its Ethernet and IP headers. Include all options and payload bytes.
Select Hex for captured byte pairs. Raw treats each character through U+00FF as one byte.
Enter Source IP and Destination IP to check the checksum. Use the final destination when IP routing headers apply.
Select Parse bytes. Read Header bytes before locating the payload in the byte table.
Select Run working sample for a SYN segment with sequence number 4294967295 and a valid checksum.

Example

Input: 30 39 00 50 ff ff ff ff 00 00 00 00 50 02 40 00 53 22 00 00

Settings: Input format: Hex; Source IP: 192.0.2.1; Destination IP: 198.51.100.2.

Result: { "Source port": 12345, "Destination port": 80, "Sequence number": 4294967295, "Acknowledgement number": 0, "Header bytes": 20, "Reserved bits": 0, "Flags": [ "SYN" ], "Window size (unscaled)": 16384, "Checksum": "0x5322", "Checksum check": { "status": "Valid", "expected": "0x5322", "IP version": 4, "Pseudo-header": "c0000201c633640200060014" }, "Urgent pointer": 0, "Options": [], "Data": "" }

This hand-worked SYN has no options or payload. Its window stays unscaled because SYN windows do not use window scaling.

Limits

The header must contain 20 through 60 bytes. Options must fit within the declared header boundary.
End of Option List stops option parsing. Every remaining header padding byte must equal zero.
Unknown options retain their kind, length, and value bytes. The parser does not infer their application meaning.
Window size remains unscaled. A single segment cannot establish the complete window-scale negotiation.
A checksum mismatch does not prove network corruption. Capture offload or incorrect IP context can also cause it.
The parser accepts at most 65535 bytes. It does not reassemble streams, recover missing segments, or validate connection state.