TCP vs UDP

TCP and UDP are transport layer protocols (Layer 4 of the OSI model). Their job is to take data from an application, break it into segments (TCP) or datagrams (UDP), add a header with source and destination port numbers, and pass it to the network layer (IP) for delivery. The key difference is that TCP provides reliable, connection-oriented communication, while UDP provides unreliable, connectionless communication.

TCP is designed for applications that require guaranteed delivery. It establishes a virtual connection between sender and receiver before any data is sent. This is called a three-way handshake:

Once connected, TCP provides: - Reliable delivery: Each segment sent is acknowledged. If the sender does not receive an ACK within a timeout (Retransmission Timeout – RTO, which is dynamically calculated based on round-trip time), it retransmits the segment. - In-order delivery: Segments are numbered with sequence numbers. The receiver reassembles them in order. If segments arrive out of order, the receiver buffers them until missing ones arrive. - Flow control: The receiver advertises a window size (in bytes) that tells the sender how much data it can accept. This prevents the sender from overwhelming the receiver. - Congestion control: TCP uses algorithms like slow start, congestion avoidance, fast retransmit, and fast recovery to adjust the sending rate based on network congestion.

TCP header is 20-60 bytes (typically 20 bytes without options). Key fields: Source Port (16 bits), Destination Port (16 bits), Sequence Number (32 bits), Acknowledgment Number (32 bits), Data Offset (4 bits), Flags (9 bits – URG, ACK, PSH, RST, SYN, FIN), Window Size (16 bits), Checksum (16 bits), Urgent Pointer (16 bits), Options (variable).

UDP is a lightweight, best-effort protocol. It does not establish a connection before sending data. Each UDP datagram is sent independently, with no guarantee of delivery, ordering, or duplicate protection. UDP has minimal overhead:

UDP header is only 8 bytes: Source Port (16 bits), Destination Port (16 bits), Length (16 bits – header + data), Checksum (16 bits, optional in IPv4 but usually used).

Because UDP is connectionless, it is faster and more efficient for applications that can tolerate some data loss, such as:

| Feature | TCP | UDP | |---------|-----|-----| | Connection | Connection-oriented (virtual circuit) | Connectionless | | Reliability | Reliable (ACKs, retransmissions) | Unreliable (no ACKs) | | Ordering | In-order delivery | No ordering | | Flow control | Yes (window size) | No | | Congestion control | Yes | No | | Overhead | High (20-60 byte header) | Low (8 byte header) | | Speed | Slower due to overhead | Faster | | Use cases | Web, email, file transfer | DNS, DHCP, VoIP, streaming |

On a Cisco router or switch, you can verify TCP and UDP connections and statistics using:

Router# show tcp brief
TCB       Local Address               Foreign Address             (state)
0x123456  192.168.1.1:23              192.168.1.100:34567        ESTAB
0x789ABC  192.168.1.1:80              10.0.0.2:54321             TIME_WAIT

Router# show udp
Proto   Local Address      Foreign Address      State
UDP     0.0.0.0:67         0.0.0.0:*            LISTEN
UDP     0.0.0.0:69         0.0.0.0:*            LISTEN

For detailed TCP statistics:

Router# show tcp statistics
Rcvd: 1000 Total, 0 Checksum errors, 0 No port
Sent: 2000 Total, 0 Retransmitted

TCP and UDP both use IP for delivery. The IP header's Protocol field indicates which transport protocol is used: 6 for TCP, 17 for UDP. Firewalls and ACLs filter based on these protocol numbers and port numbers. For example, to allow web traffic, you permit TCP port 80. To allow DNS, you permit UDP port 53 (and TCP port 53 for zone transfers).

In an enterprise network, choosing between TCP and UDP is a daily decision for application developers and network engineers. For example, consider a company that deploys a Voice over IP (VoIP) system using the Session Initiation Protocol (SIP) for signaling and Real-time Transport Protocol (RTP) for media. SIP typically uses UDP port 5060 for fast call setup, but it can also use TCP if reliability is needed (e.g., for registration). RTP uses UDP ports in the range 16384-32767 because voice packets must arrive with low latency and jitter; a lost packet is better than a delayed retransmission. A network engineer must configure QoS to mark RTP traffic with DSCP EF (Expedited Forwarding) to ensure priority, while SIP signaling might be marked AF41. If the engineer mistakenly uses TCP for RTP, the voice quality would suffer due to retransmissions causing delay and jitter.

Another scenario is a financial trading firm that requires reliable, low-latency data feeds. They might use a proprietary protocol over UDP with application-level acknowledgments to get the speed of UDP with custom reliability. However, for order execution, they often use TCP to guarantee that orders are received exactly once. The network engineer must ensure that firewalls allow these specific UDP ports and that the network does not drop UDP packets due to congestion. If UDP packets are dropped, the trading application may lose data, leading to incorrect pricing. To mitigate this, the engineer might increase buffer sizes or use traffic shaping.

A common misconfiguration is blocking UDP port 53 (DNS) on a firewall, which breaks all name resolution. Similarly, blocking UDP 67/68 (DHCP) prevents devices from obtaining IP addresses. Network engineers must carefully audit ACLs to ensure essential UDP services are allowed. When troubleshooting, they use commands like show ip access-lists to verify rules and debug ip udp (with caution) to see UDP packets. In large networks, they also monitor TCP connection states using show tcp brief to detect half-open connections or excessive retransmissions, which indicate network problems.