S1 / 14 MODULE 14 / TCP AND UDP
Connect applications.
Deliver the data.
The transport layer provides communication between application processes. TCP and UDP use port numbers to identify services, but they offer different reliability and overhead trade-offs.
Understand transport-layer roles
Transport protocols identify application endpoints with source and destination port numbers. A TCP connection is identified by a four-tuple: source IP, source port, destination IP, and destination port. This allows many simultaneous conversations to share one host IP address. The sender multiplexes application data, and the receiver demultiplexes it to the correct socket/process. TCP and UDP are the primary transport protocols in the TCP/IP suite.
IMG-1134 · IMG-1125Compare TCP and UDP
TCP is connection-oriented and provides an ordered, reliable byte stream using sequence numbers, acknowledgments, retransmissions, and flow control. TCP does not preserve application message boundaries: one application write can be split across several reads, or several writes can be combined in one read. Applications must define their own framing. UDP is connectionless and has a fixed 8-byte header, but does not provide TCP-style sequencing, acknowledgments, retransmission, or flow control.
IMG-1272 · IMG-1259 · IMG-1261 · IMG-1319 · IMG-1305Use ports and reliability mechanisms
Port numbers identify application endpoints. Common well-known examples include DNS 53, SSH 22, Telnet 23, SMTP 25, DHCP UDP 67/68, TFTP 69, HTTP 80, POP3 110, IMAP 143, and HTTPS 443. FTP commonly uses TCP 21 for control and TCP 20 for active-mode data. Well-known ports are 0–1023, registered ports are 1024–49151, and dynamic/private ports are 49152–65535. IANA maintains the service-name and port-number registries. TCP sequence numbers identify bytes in the stream; acknowledgments identify the next byte expected. The SYN, SYN-ACK, ACK handshake establishes a connection.
IMG-1168 · IMG-1322Read TCP and UDP headers
The basic UDP header is 8 bytes and contains source port, destination port, length, and checksum. The UDP Length field includes both the 8-byte header and its payload. The UDP checksum detects corruption; an IPv4 sender may use a zero checksum to indicate no checksum was generated, while UDP checksums are generally mandatory for IPv6 (with narrow tunnel-specific exceptions). TCP has a larger header with sequence number, acknowledgment number, flags, window size, checksum, and other fields. TCP sequence numbers count bytes; the SYN and FIN flags each consume one sequence number even when they carry no application data.
UDP: ports · length · checksum | TCP: ports · sequence · ACK · flags · windowManage TCP connections and sending rates
A typical TCP close uses FIN, ACK, FIN, ACK; each direction closes independently. RST aborts or rejects a connection rather than performing an orderly close. The active closer normally enters TIME-WAIT after its final ACK. A cumulative ACK identifies the next byte expected; duplicate ACKs can indicate a gap and trigger fast retransmission. SACK can report noncontiguous blocks already received beyond that gap. The receiver-advertised window (rwnd) protects the receiver; the congestion window (cwnd) responds to conditions in the network path. The sender is constrained by the effective minimum of rwnd and cwnd, minus data already outstanding. MSS limits TCP payload, while MTU limits the Layer 3 packet size carried by a link.
FIN/RST · TIME-WAIT · ACK/SACK · rwnd/cwnd · MSS/MTUChoose UDP or TCP for the application
Live voice/video often uses UDP because timeliness can matter more than retransmitting late data. DNS commonly uses UDP for ordinary queries but can retry over TCP when a response is truncated; TCP is also used for zone transfers. HTTP/1.1 and HTTP/2 commonly use TCP, while HTTP/3 uses QUIC over UDP 443. DHCP uses UDP 68 from client to server port 67, with replies from server 67 to client 68. These are application choices, not guarantees that UDP data is reliable or that TCP always has lower latency.
RTP/media · DNS UDP/TCP · DHCP UDP 67/68Inspect active sockets and ports
Socket-table tools show local and foreign addresses, ports, protocol, and connection state. On Windows, netstat -ano can display endpoints and process IDs; on Linux, ss -tunap provides protocol, endpoint, and process information when permissions allow. An ESTABLISHED TCP row identifies an active four-tuple; a LISTEN row identifies a local service waiting for connections. A port number alone does not prove that the application is healthy or reachable through every firewall.
Windows: netstat -ano · Linux: ss -tunapCHECK YOUR UNDERSTANDING
Transport Layer
Practice the key terms, procedures, and troubleshooting decisions from this module.