HEX2BIN

Converts a hexadecimal number to binary.

Syntax:

HEX2BIN(hexadecimalnumber, numdigits)

returns text representing a binary number, given hexadecimalnumber, which may be text, or a number (taken to be hexadecimal although it is not).

The binary number returned may have up to ten bits in two's complement representation; positive numbers are 0 to 111111111 (nine bits representing 0 to 511 decimal) and negative numbers 1111111111 to 1000000000 (ten bits representing -1 to -512 decimal).

hexadecimalnumber must therefore also lie in this range, and is given in two's complement form with up to ten digits.

numdigits is an optional number specifying the number of digits to return.

Example:

HEX2BIN("1D")

returns 11101 as text.

HEX2BIN(10)

returns 10000 as text. The number 10 is read as hexadecimal.

HEX2BIN("2", 4)

returns 0010 as text. HEX2BIN adds leading zeroes to make 4 digits.

HEX2BIN("FFFFFFFFFE")

returns 1111111110 as text (twos complement representation of decimal -2).

Application:

Analyzing a TCP Header Flag

A TCP (Transmission Control Protocol) header is a crucial part of a network packet that ensures reliable data transmission. One specific byte in the TCP header, often called the "flags" byte, contains several single-bit flags that control the communication process.

Let's say you've captured a network packet, and the flags byte of the TCP header has the hexadecimal value 0x18. You want to know which specific flags are set to 1 (active).

Step 1: Identify the Hexadecimal Value The hexadecimal value for the TCP flags byte is 18.

Step 2: Use the HEX2BIN Function You would use the HEX2BIN function to convert 18 to its binary equivalent. HEX2BIN("18")

Step 3: The Result The function returns the binary value 00011000.

Step 4: Interpret the Binary Result Now, you can break down this binary string to understand which flags are set. The flags byte is typically 8 bits long, with each bit representing a different flag.

The order of the flags (from left to right) is as follows:

	Bit Position	Flag Name	Description
	A	B	C
1	Bit 7	URG	Urgent Pointer field significant
2	Bit 6	ACK	Acknowledgment field significant
3	Bit 5	PSH	Push function
4	Bit 4	RST	Reset the connection
5	Bit 3	SYN	Synchronize sequence numbers
6	Bit 2	FIN	No more data from sender
7	Bit 1	(Reserved)	Reserved for future use
8	Bit 0	(Reserved)	Reserved for future use

Resulting Table:

Let's apply the binary result 00011000 to this table.

	Bit Position	Flag Name	Binary Value	Is Set?
	A	B	C	D
1	Bit 7	URG	0	No
2	Bit 6	ACK	1	Yes
3	Bit 5	PSH	0	No
4	Bit 4	RST	0	No
5	Bit 3	SYN	1	Yes
6	Bit 2	FIN	0	No
7	Bit 1	(Reserved)	0	No
8	Bit 0	(Reserved)	0	No

Conclusion:

By using the HEX2BIN function, we converted the hexadecimal value 18 to binary 00011000. This analysis reveals that the ACK (Acknowledgment) and SYN (Synchronize) flags are set. This is a common combination for the initial packet (the SYN-ACK packet) in the TCP three-way handshake, which is the process used to establish a TCP connection.