Which bit represents which TCP flag


For instance, a WireShark capture filter example I found – tcp[13] & 8 == 8 represents packets with PSH flags.

How do I count the 8 ?

Based on the wikipedia image,
enter image description here

PSH is in the middle of the TCP flags segment. Counting 1 from the NS flag, PSH bit representation should be 6 ?

Any guidance is appreciated.

Best Answer

You should look at tcpdump man page, "Capturing TCP packets with particular flag combinations" section - it's a lots of details here.