Networking › Module 4 › Lesson 1
TCP vs UDP Explained
Connection-oriented TCP vs fast UDP—and when each matters
Opening
Two ways to move data at Layer 4
TCP and UDP both ride on IP, but they trade reliability for speed differently. Firewalls, IDS rules, and troubleshooting all assume you know which transport a service uses—and what "no response" might mean for each.
1. TCP — Reliable and Connection-Oriented
TCP (Transmission Control Protocol) establishes a connection with a three-way handshake (SYN, SYN-ACK, ACK). It numbers segments, acknowledges receipt, and retransmits lost packets. Use cases: HTTP/HTTPS, SSH, email, file transfers—anything that must arrive complete and in order. Downside: more overhead and latency than UDP.
2. UDP — Fast and Connectionless
UDP (User Datagram Protocol) sends datagrams without setting up a session. No guaranteed delivery or ordering. Use cases: DNS queries, VoIP, video streaming, gaming—where speed beats perfect reliability. Security teams watch for UDP abuse in amplification DDoS (small query, large reflected response).
3. Side-by-Side
TCP
Stateful, retransmits, flow control—expect established connections in ss or netstat.
UDP
Stateless datagrams—listening service may show udp in ss -uln without "ESTABLISHED" peers.
Firewall hint
Blocking TCP may break web and SSH; blocking UDP may break DNS and real-time apps.
Knowledge Check
TCP is best described as:
Multiple choice
Knowledge Check
DNS lookups commonly use:
Multiple choice
Knowledge Check
The TCP three-way handshake begins with:
Multiple choice