TCP flags occupy 1 byte, and that’s it. Why does Wireshark/etc. say “0x0018 (PSH, ACK)?” instead? Why not? What is the deal with this? It’s late on a Saturday night and I’m analyzing traffic. I don’t care if this sounds like mindless rambling. W00t.)Here are TCP flags from a random segment. The flags occupy just one byte. They are not set. Why not set?”]
Source: https://taosecurity.blogspot.com/2006/08/real-wireshark-quirk.html