IP, TCP, and UDP
These are the core transport and network layer protocols that make the internet work.
Internet Protocol (IP)
IP is a connectionless, best-effort protocol responsible for addressing and routing packets between networks.
IPv4 Header Key Fields
| Field | Purpose |
|---|---|
| Version | 4 or 6 |
| TTL (Time to Live) | Hop count limit (prevents loops) |
| Protocol | What’s inside (TCP=6, UDP=17, ICMP=1) |
| Source/Destination IP | Endpoints |
| Header Checksum | Error detection |
IP Characteristics
- Connectionless: No handshake before sending
- Best-effort: No guarantee of delivery, ordering, or integrity
- Unreliable: Higher layers handle reliability if needed
- Route-based: Each packet routed independently
Transmission Control Protocol (TCP)
TCP is connection-oriented, reliable, and provides flow/congestion control. It guarantees delivery and ordering.
TCP Three-Way Handshake
sequenceDiagram
participant Client
participant Server
Client->>Server: SYN (seq=x)
Server->>Client: SYN-ACK (seq=y, ack=x+1)
Client->>Server: ACK (ack=y+1)
Note over Client,Server: Connection Established
TCP Four-Way Teardown
sequenceDiagram
participant Client
participant Server
Client->>Server: FIN
Server->>Client: ACK
Server->>Client: FIN
Client->>Server: ACK
Note over Client,Server: Connection Closed
Key TCP Features
| Feature | Description |
|---|---|
| Reliability | Acknowledgments and retransmissions ensure delivery |
| Ordered Delivery | Sequence numbers ensure packets reassembled in order |
| Flow Control | Window size prevents overwhelming receiver (sliding window) |
| Congestion Control | Slow start, congestion avoidance adapt to network conditions |
| Connection-Oriented | State maintained on both ends |
TCP Header Key Fields
| Field | Purpose |
|---|---|
| Source/Dest Port | Identify applications |
| Sequence Number | Order of bytes |
| Acknowledgment Number | Next expected byte |
| Flags | SYN, ACK, FIN, RST, PSH, URG |
| Window Size | Flow control |
| Checksum | Error detection |
User Datagram Protocol (UDP)
UDP is connectionless, unreliable, but fast and lightweight. No handshake, no retransmissions.
UDP Characteristics
- Connectionless: No setup overhead
- Unreliable: No guarantee of delivery
- No ordering: Packets may arrive out of order
- Low overhead: Small header (8 bytes vs TCP 20+)
- No flow/congestion control: Sends as fast as application allows
UDP Header
Only 4 fields: Source Port, Destination Port, Length, Checksum (8 bytes total)
TCP vs UDP Comparison
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented | Connectionless |
| Reliability | Guaranteed delivery | Best effort |
| Ordering | Guaranteed | Not guaranteed |
| Speed | Slower (overhead) | Faster (minimal overhead) |
| Flow Control | Yes | No |
| Congestion Control | Yes | No |
| Use Cases | HTTP, HTTPS, SSH, FTP, email | DNS, DHCP, streaming, VoIP, gaming, QUIC |
Common Port Numbers
| Port | Protocol | Service |
|---|---|---|
| 22 | TCP | SSH |
| 53 | TCP/UDP | DNS |
| 80 | TCP | HTTP |
| 443 | TCP | HTTPS |
| 67/68 | UDP | DHCP |
| 123 | UDP | NTP |
| 3389 | TCP | RDP |
Real-World Examples
- Web browsing (HTTP/HTTPS): TCP for reliability (you need all data)
- DNS lookups: Usually UDP for speed (small queries), TCP for zone transfers/large responses
- Video streaming: Often UDP or QUIC (some loss acceptable for speed)
- Voice calls (VoIP): UDP preferred (latency > small packet loss)
- File transfer: TCP for completeness
Debugging Tips
# Check TCP connections
ss -tuln
netstat -tuln
# Test TCP connectivity
nc -vz example.com 443
telnet example.com 80
# Test with curl (uses TCP)
curl -v https://example.com
# Packet capture
tcpdump -i eth0 port 443 -w capture.pcap
Related Notes
- DNS DHCP ICMP — DNS uses UDP/TCP
- TLS And HTTPS — HTTP/3 uses QUIC over UDP
- Packet Analysis Wireshark — Analyze TCP/UDP
- OSI TCPIP Models — Transport layer position
Sources
- RFC 793 (TCP)
- RFC 768 (UDP)
- RFC 791 (IP)
- Kurose & Ross - Computer Networking
- TCP/IP Illustrated Vol. 1 (Stevens)