title: Why is the ACK flag in a tcpdump represented as a period "." instead of an "A"?
body: <p>This is the output of the three way handshake of a TCP connection:</p>
  
  <pre><code>23:40:36.011400 IP 10.1.1.11.44733 &gt; 73.5.9.44.80: Flags [S], seq 106492654, win 64240, optio0
  23:40:36.013994 IP 73.5.9.44.80 &gt; 10.1.1.11.44733: Flags [S.], seq 712839050, ack 106492655, 0
  23:40:36.014026 IP 10.1.1.11.44733 &gt; 73.5.9.44.80: Flags [.], ack 1, win 502, options [nop,no0
  </code></pre>
  
  <p>Inside the brackets are the flags for each packet: <code>[S]</code> <code>[S.]</code> <code>[.]</code></p>
  
  <p>The <a href="https://www.tcpdump.org/manpages/tcpdump.1.html" rel="nofollow noreferrer">man page for tcpdump</a> describes these values:</p>
  
  <blockquote>
    <p>The general format of a TCP protocol line is:</p>
    
    <p>src > dst: Flags <strong>[tcpflags]</strong>, seq data-seqno, ack ackno, win window,
    urg urgent, options [opts], length len</p>
    
    <p>Src and dst are the source and destination IP addresses and ports.
    Tcpflags are some combination of <strong>S (SYN)</strong>, F (FIN), P (PUSH), R (RST),
    U (URG), W (ECN CWR), E (ECN-Echo) or <strong>'.' (ACK)</strong>, or 'none' if no flags
    are set</p>
  </blockquote>
  
  <h3>Why is the ACK flag represented by a period (<code>.</code>) instead of an <code>A</code>?</h3>
  
  <p>Some googling lead me to this:
  <a href="https://github.com/the-tcpdump-group/tcpdump/issues/319" rel="nofollow noreferrer">https://github.com/the-tcpdump-group/tcpdump/issues/319</a></p>
  
  <p>Which implies the reason for not using an <code>A</code> is described here:
  <a href="http://article.gmane.org/gmane.network.tcpdump.devel/6383" rel="nofollow noreferrer">http://article.gmane.org/gmane.network.tcpdump.devel/6383</a></p>
  
  <p>But this link has been giving me a 522 error =/</p>