TCP Header Anatomy

Every field of the header, on a real packet

Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.

What you'll be able to do

▸Name every field of the TCP header and its size
▸Explain what ports, sequence/ack numbers, flags, and the window are for
▸Read a real TCP header out of raw bytes in the hex view

Before this lesson — it builds directly on:

TCP Foundations

When you send data over a network, the data alone isn't enough. The other machine needs to know which program should receive it, where these bytes fit among everything else you've sent, whether anything is missing, and how much more it may send you. None of that is part of your data — so TCP puts it in a fixed block of metadata at the front of every segment. That block is the header, and it is the same shape in every TCP segment ever sent.

Header: Fixed-format metadata at the front of the segment. Not your data — the machinery that carries it.
Payload: The application bytes being carried. A segment may have none (a pure ACK).
Field: One named value inside the header at a known offset — e.g. the 2 bytes at offset 0 are always the source port.
Optionglossary: Optional extra header data beyond the fixed 20 bytes, mostly used on the SYN to announce capabilities.
MSSglossary: Maximum Segment Size: the largest PAYLOAD this host wants per segment. Announced in an option; excludes headers.

✗ Common misunderstanding: MSS and MTU are the same number.

Why that's wrong: MTU is the largest packet a link accepts INCLUDING headers; MSS counts only TCP payload. On classic Ethernet: 1500 − 20 (IP) − 20 (TCP) = 1460.

Correct model: MTU is the truck's weight limit; MSS is how much cargo fits once packaging is subtracted.

The packets prove it: The SYN advertises MSS 1460 while the full frame carrying a maximum segment is 1514 bytes — check the Ethernet layer's byte count.

Watch these fields in the lab: tcp.sourcePort · tcp.dataOffset · tcp.options[0]

✓ Concept check — before you open the packets

These test the idea, not the trace. You should be able to answer them from the explanation above.

A host announces MSS 1460 on an Ethernet link with a 1500-byte MTU. How big is the full frame when it sends a maximum-sized segment?

Which statement about the TCP header is true?

Now that you understand the concept, observe how it appears in the packet exchange.

The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.