Compare TCP to UDP

The Transport layer (Layer 4) delivers data between applications on two hosts. IP (Layer 3) can get a packet to the right computer, but a computer runs many programs at once; the transport layer’s port numbers identify which program the data belongs to. The two transport protocols on the exam, TCP and UDP, both provide ports, but they make opposite trade-offs between reliability and speed.

Port numbers and sockets

A port is a 16-bit number (0 to 65535) in the TCP or UDP header. A server process listens on a fixed, well-known port so clients know where to find it; the client picks a random high-numbered ephemeral (temporary) source port for its side of the conversation. The combination of IP address, protocol, and port is a socket, such as 192.0.2.10:443. A single connection is uniquely identified by the pair of sockets at each end, which is how one web server can serve thousands of clients on port 443 at the same time.

IANA divides the port range as follows:

TCP: Transmission Control Protocol

TCP is connection-oriented and reliable. Before any data is sent, the two hosts establish a connection with the three-way handshake:

1. Client sends a segment with the SYN flag set (synchronize), proposing an initial sequence number.
2. Server replies with SYN-ACK (its own SYN plus an acknowledgment of the client’s).
3. Client sends ACK. The connection is now established and data can flow.

A connection is closed gracefully with a four-way exchange of FIN and ACK segments, or abruptly with RST (reset).

TCP’s key mechanisms are all in its header, which is at least 20 bytes:

• Sequence numbers count every byte sent, so the receiver can put segments back in order and detect gaps.
• Acknowledgment numbers tell the sender the next byte the receiver expects. If an ACK does not arrive in time, the sender retransmits. This is error recovery.
• Windowing (flow control): the receiver advertises a window size, the number of bytes it can accept before the sender must stop and wait for an ACK. The window grows when things go well and shrinks when the receiver is overloaded (a sliding window). Combined with congestion-control algorithms, this lets TCP fill a link without overwhelming it.
• Segmentation: TCP breaks a large application message into segments that fit in an IP packet and reassembles them on the far end.
• Checksum: detects corruption of the header and data.
• Flags: SYN, ACK, FIN, RST, PSH, URG.

The cost of reliability is overhead: the handshake adds a round-trip before any data flows, every segment must be acknowledged, and a lost segment stalls everything behind it while it is retransmitted. TCP is used whenever every byte must arrive intact and in order: web pages (HTTP/HTTPS), email (SMTP, POP3, IMAP), file transfer (FTP), remote login (SSH, Telnet), and database traffic.

UDP: User Datagram Protocol

UDP is connectionless and unreliable (“best effort”). There is no handshake, no sequence numbers, no acknowledgments, no retransmission, and no flow control. The header is only 8 bytes: source port, destination port, length, and checksum. A UDP sender just sends; if a datagram is lost, it is up to the application to notice and decide what to do.

That sounds worse, but for many applications it is better:

• Real-time media (voice over IP, video conferencing, streaming, gaming): a retransmitted voice packet would arrive too late to be useful, so it is better to skip it and keep going. Low latency and low overhead matter more than perfection.
• Simple request/response protocols (DNS, DHCP, SNMP, NTP, TFTP, syslog, RADIUS): the exchange is one small packet each way, so a three-way handshake would triple the traffic. The application simply resends if it gets no answer.
• Broadcast and multicast: TCP is strictly one-to-one; only UDP can send to a broadcast or multicast address, which is why DHCP and RIP use it.

Common port numbers

You must memorize these. The exam asks directly (“which port does TFTP use?”) and indirectly (an ACL that must permit DNS traffic).

Two older RADIUS port numbers, 1645 and 1646, are still seen on some servers and Cisco devices default to them for the radius-server host legacy command; the official IANA assignments are 1812 and 1813.