# IP, TCP, and UDP

These are the core transport and network layer protocols that make the internet work.

## Internet Protocol (IP)

IP is a connectionless, best-effort protocol responsible for addressing and routing packets between networks.

### IPv4 Header Key Fields
| Field | Purpose |
|---|---|
| **Version** | 4 or 6 |
| **TTL (Time to Live)** | Hop count limit (prevents loops) |
| **Protocol** | What’s inside (TCP=6, UDP=17, ICMP=1) |
| **Source/Destination IP** | Endpoints |
| **Header Checksum** | Error detection |

### IP Characteristics
- **Connectionless**: No handshake before sending
- **Best-effort**: No guarantee of delivery, ordering, or integrity
- **Unreliable**: Higher layers handle reliability if needed
- **Route-based**: Each packet routed independently

## Transmission Control Protocol (TCP)

TCP is connection-oriented, reliable, and provides flow/congestion control. It guarantees delivery and ordering.

### TCP Three-Way Handshake
```mermaid
sequenceDiagram
    participant Client
    participant Server
    Client->>Server: SYN (seq=x)
    Server->>Client: SYN-ACK (seq=y, ack=x+1)
    Client->>Server: ACK (ack=y+1)
    Note over Client,Server: Connection Established
```

### TCP Four-Way Teardown
```mermaid
sequenceDiagram
    participant Client
    participant Server
    Client->>Server: FIN
    Server->>Client: ACK
    Server->>Client: FIN
    Client->>Server: ACK
    Note over Client,Server: Connection Closed
```

### Key TCP Features

| Feature | Description |
|---|---|
| **Reliability** | Acknowledgments and retransmissions ensure delivery |
| **Ordered Delivery** | Sequence numbers ensure packets reassembled in order |
| **Flow Control** | Window size prevents overwhelming receiver (sliding window) |
| **Congestion Control** | Slow start, congestion avoidance adapt to network conditions |
| **Connection-Oriented** | State maintained on both ends |

### TCP Header Key Fields
| Field | Purpose |
|---|---|
| **Source/Dest Port** | Identify applications |
| **Sequence Number** | Order of bytes |
| **Acknowledgment Number** | Next expected byte |
| **Flags** | SYN, ACK, FIN, RST, PSH, URG |
| **Window Size** | Flow control |
| **Checksum** | Error detection |

## User Datagram Protocol (UDP)

UDP is connectionless, unreliable, but fast and lightweight. No handshake, no retransmissions.

### UDP Characteristics
- **Connectionless**: No setup overhead
- **Unreliable**: No guarantee of delivery
- **No ordering**: Packets may arrive out of order
- **Low overhead**: Small header (8 bytes vs TCP 20+)
- **No flow/congestion control**: Sends as fast as application allows

### UDP Header
Only 4 fields: Source Port, Destination Port, Length, Checksum (8 bytes total)

## TCP vs UDP Comparison

| Feature | TCP | UDP |
|---|---|---|
| **Connection** | Connection-oriented | Connectionless |
| **Reliability** | Guaranteed delivery | Best effort |
| **Ordering** | Guaranteed | Not guaranteed |
| **Speed** | Slower (overhead) | Faster (minimal overhead) |
| **Flow Control** | Yes | No |
| **Congestion Control** | Yes | No |
| **Use Cases** | HTTP, HTTPS, SSH, FTP, email | DNS, DHCP, streaming, VoIP, gaming, QUIC |

## Common Port Numbers

| Port | Protocol | Service |
|---|---|---|
| **22** | TCP | SSH |
| **53** | TCP/UDP | DNS |
| **80** | TCP | HTTP |
| **443** | TCP | HTTPS |
| **67/68** | UDP | DHCP |
| **123** | UDP | NTP |
| **3389** | TCP | RDP |

## Real-World Examples

- **Web browsing (HTTP/HTTPS)**: TCP for reliability (you need all data)
- **DNS lookups**: Usually UDP for speed (small queries), TCP for zone transfers/large responses
- **Video streaming**: Often UDP or QUIC (some loss acceptable for speed)
- **Voice calls (VoIP)**: UDP preferred (latency > small packet loss)
- **File transfer**: TCP for completeness

## Debugging Tips

```bash
# Check TCP connections
ss -tuln
netstat -tuln

# Test TCP connectivity
nc -vz example.com 443
telnet example.com 80

# Test with curl (uses TCP)
curl -v https://example.com

# Packet capture
tcpdump -i eth0 port 443 -w capture.pcap
```

## Related Notes

- [[Core-Protocols/DNS-DHCP-ICMP.md]] — DNS uses UDP/TCP
- [[Core-Protocols/TLS-And-HTTPS.md]] — HTTP/3 uses QUIC over UDP
- [[Automation-Observability/Packet-Analysis-Wireshark.md]] — Analyze TCP/UDP
- [[Foundations/OSI-TCPIP-Models.md]] — Transport layer position

## Sources

* RFC 793 (TCP)  
* RFC 768 (UDP)  
* RFC 791 (IP)  
* Kurose & Ross - *Computer Networking*  
* TCP/IP Illustrated Vol. 1 (Stevens)