Hex conversion on TCP flags

Z0sickx · August 2016

Hi i'm having trouble grasping this after i saw a question like this in a search on wireshark TCP flag filters

why does TCP flag==0x12 = SYN/ACK?

i understand that:

FIN=1
SYN=2
RST=4
PSH=8
ACK=16
URG=32

and understand HEX is base 16 and decimal is Base 10.

every tutorial i look at when it comes to HEX--> DEC or BINARY shows no examples in the "0x12" format. if someone could show me how to understand why 0x12= 18 in decimal.

do i ignore the "0" in 0x12 and just focus on "12"

the only way this makes sensee to me is if "1" and "2" are separated out

1x16 + 2=18?

rob42 · August 2016

When reading about computer programming such as C or Python, 0x12 mean 'the HEX number 12'. If it was just written as '12', the reader would assume the Decimal number 12, so any number that's prefixed '0x', as assumed to mean HEX notation.

To understand why TCP flag==0x12 = SYN/ACK, you need to be looking at the Binary notation.

0x12 = 1 0 0 1 0

Mapping the Binary Bits to the Flag positions...

NS

CWR

ECE
URG
ACK
PSH
RST
SYN
FIN

0
0
0
0
1
0
0
1
0

That's my understanding and I hope this helps you, but I'm sure someone with better knowledge than mine will correct this if I'm wrong; I am after all new to this myself.

Best regards,

Rob

Z0sickx · August 2016

rob42 wrote: »

When reading about computer programming such as C or Python, 0x12 mean 'the HEX number 12'. If it was just written as '12', the reader would assume the Decimal number 12, so any number that's prefixed '0x', as assumed to mean HEX notation.

To understand why TCP flag==0x12 = SYN/ACK, you need to be looking at the Binary notation.

0x12 = 1 0 0 1 0

Mapping the Binary Bits to the Flag positions...

NS
CWR
ECE
URG
ACK
PSH
RST
SYN
FIN

0
0
0
0
1
0
0
1
0

That's my understanding and I hope this helps you, but I'm sure someone with better knowledge than mine will correct this if I'm wrong; I am after all new to this myself.

Best regards,

Rob

I need the details on how you go from 12 hex to 18 decimal, i don't understand the math.
i understand now the "0x12" identifying it now so thank you for that. but if i read it as "12 hex" in my head i see "C" and in binary thats 1100

clarson · August 2016

your close but not right.

each digit of a number is the base raised to a power.
as for decimal (base 10). 123 is 1 x 10^2 + 2 x 10^1 + 3 x 10^0 = 100 + 20 + 3 = 123

for hex (base 16) 0x12 is 1 x 16^1 + 2 x 16^0 = 16 + 2 which in decimal that is 18 which in binary is 10010
each hex digit is 4 bits in binary, so a two digit hex number requires at least 5 bits in binary.
So, you should be seeing 0001 0010.

for octal (base 8 ) 12 is 1 x 8^1 + 2 x 8^0 = 8 + 2 which in decimal is 10 and 10 in hex is 0xA in binary is 1010

but decimal 12 is 0xC in hex

Z0sickx · August 2016

clarson wrote: »

your close but not right.

each digit of a number is the base raised to a power.
as for decimal (base 10). 123 is 1 x 10^2 + 2 x 10^1 + 3 x 10^0 = 100 + 20 + 3 = 123

for hex (base 16) 0x12 is 1 x 16^1 + 2 x 16^0 = 16 + 2 which in decimal that is 18 which in binary is 10010
each hex digit is 4 bits in binary, so a two digit hex number requires at least 5 bits in binary.

for octal (base 8 ) 12 is 1 x 8^1 + 2 x 8^0 = 8 + 2 which in decimal is 10 and 10 in hex is 0xA in binary is 1010

but decimal 12 is 0xC in hex

Thank you!

rob42 · August 2016

Spot on explanation from Clarson.

Not sure if this adds an value to the Thread, but I should have said...

Don't think of 0x12 as 'HEX Twelve', rather think of it being 'HEX One|Two' or, as Clarson rightly points out, 0001|0010.

All the best with your studies.

OctalDump · August 2016

The other thing, and this might just confuse things more, is that two digits of hex is 8 digits in binary (or 8 bits). This means each hex digit is 4 bits. So if you can get comfortable thinking in 4 bits at a time, it can be easier to convert hex to binary (and skip the decimal).

Hex conversion on TCP flags

Comments