Revision history [back]

If you look at the expansion of a TCP header, Flags field, in the packet details pane you can see the entry displayed as:

[TCP Flags: ··········S·]

where the "·" represents the flags not set and the "S" represents (in this case) the SYN flag being set in the TCP header flags field. The display uses the initial letter of the flag "name" if it's set, e.g. "A" for Acknowledgement The square brackets indicate that this is a Wireshark synthesised item and isn't part of the protocol.

In the output, "\x" indicates an escape for a following hex value, so "\xc2" is the hex value 0xc2. These are actually UTF-8 characters, so they have to be combined as 0xc0 indicates a 2 byte UTF-8 character giving 0xc2b7 which is the UTF-8 representation of the Unicode point U+00B7 which is a "middle dot". In the middle of a string you can see an "A". This is the UTF-8 representation of an "A".

If you look at the expansion of a TCP header, Flags field, in the packet details pane you can see the entry displayed as:

[TCP Flags: ··········S·]

where the "·" represents the flags not set and the "S" represents (in this case) the SYN flag being set in the TCP header flags field. The display uses the initial letter of the flag "name" if it's set, e.g. "A" for Acknowledgement The square brackets indicate that this is a Wireshark synthesised item and isn't part of the protocol.

In the output, "\x" indicates an escape for a following hex value, so "\xc2" is the hex value 0xc2. These are actually UTF-8 characters, so they have to be combined as 0xc0 indicates a 2 byte UTF-8 character giving 0xc2b7 which is the UTF-8 representation of the Unicode point U+00B7 which is a "middle dot". In the middle of a the string you can see an "A". This is the UTF-8 representation of an "A".