TCP flags present in the header

Question

Hi,

on my ubuntu 9.04 the /usr/include/netinet/tcp.h defines the tcp header as follows

struct tcphdr
  {
    u_int16_t source;
    u_int16_t dest;
    u_int32_t seq;
    u_int32_t ack_seq;
#  if __BYTE_ORDER == __LITTLE_ENDIAN
    u_int16_t res1:4;
    u_int16_t doff:4;
    u_int16_t fin:1;
    u_int16_t syn:1;
    u_int16_t rst:1;
    u_int16_t psh:1;
    u_int16_t ack:1;
    u_int16_t urg:1;
    u_int16_t res2:2;
#  elif __BYTE_ORDER == __BIG_ENDIAN
    u_int16_t doff:4;
    u_int16_t res1:4;
    u_int16_t res2:2;
    u_int16_t urg:1;
    u_int16_t ack:1;
    u_int16_t psh:1;
    u_int16_t rst:1;
    u_int16_t syn:1;
    u_int16_t fin:1;
#  else
#   error "Adjust your <bits/endian.h> defines"
#  endif
    u_int16_t window;
    u_int16_t check;
    u_int16_t urg_ptr;
};

In the flags section, FIN,SYN,RST,PSH,ACK,URG values are defined whereas i can't find the ECE and CWR flags. What do the res1,res2 and doff values defined in the struct tcphdr mean? Is there anyway to access the ECE and CWR flag values too?

Thanks.

Answer 1

I believe that your ECE and CWR TCP flags are contained in the 'res2' struct member this TCP Header Image shows that the ECE and CWR bits ride next to URG.

Answer 2

Yeah they are part of the "reserved 6 bits" (res1 + res2). They are optional and are more or less resent addition (Stevens' book does not even mention them). Doff is 4 bits and specifies header length which is normally 20 bytes but can be longer if options like MSS is included.

Answer 3

This Perl 'NetPacket::TCP' TCP Encode-Decode code shows ECN and Control bit interpretation.
However, the Networksorcery TCP page is a better reference for these bits.

# TCP Flags
use constant FIN => 0x01;
use constant SYN => 0x02;
use constant RST => 0x04;
use constant PSH => 0x08;
use constant ACK => 0x10;
use constant URG => 0x20;
use constant ECE => 0x40;
use constant CWR => 0x80;

The two flags, 'CWR' and 'ECE' are for Explicit Congestion Notification as defined in RFC 3168.
The Wikipedia link is a good source for information & implementation of optional ECN support.
^{Including the Floyd ECN page reference at the end.}
It is important to note that ECN is not supported unless both TCP endpoints are capable.
To this end it is not seen often (on the wire and TCP code likewise).

Also note that the IP Header for implementations that support ECN
will also carry the two-bit ECN field in its TOS bits.