Understanding TCP Flags in AWS VPC Flow Logs

TCP flags in AWS VPC Flow Logs provide valuable information about the state and direction of TCP connections. These flags are binary indicators represented as a decimal value in flow logs.

‍

What are TCP Flags?

TCP flags are control bits in the TCP header that indicate specific conditions during data transmission. 

In VPC Flow Logs, these flags are bit masks, meaning they can be combined to create unique numbers. These combinations happen when multiple requests occur within the "aggregation interval" of the flow logs.

The decimal value is the sum of all active TCP flags in the connection, with each flag representing a specific binary position.

Below some examples:

• FIN — 1
• SYN — 2
• RST — 4
• SYN-ACK — 18

FIN

Decimal Value: 1

SYN

Decimal Value: 2

RST

Decimal Value: 4

SYN-ACK

Decimal Value: 18

‍

Common TCP Flag Combinations

The following table presents the most commonly observed TCP flag combinations in VPC Flow Logs.

While there are other possible flag combinations, these patterns represent the typical connection lifecycle events you'll encounter when analyzing your network traffic.

‍

‍

‍