TCP, UDP and Ports

Two ways to send data

IP gets packets to the right computer, but it makes no promises. Packets can arrive late, out of order, twice or not at all. The Transport layer (layer 4) sits on top of IP and decides how much of that to fix. There are two main protocols to choose from:

• TCP (Transmission Control Protocol) sets up a connection first, then makes sure everything arrives complete and in order.
• UDP (User Datagram Protocol) just sends. It does not set up a connection and does not check whether the data arrived.

Each program picks the one that suits its job.

TCP: reliable delivery

TCP promises that data arrives complete, in order and without errors. Before it sends anything, the two devices set up a connection with a three-way handshake:

1. SYN: the client says it wants to open a connection.
2. SYN-ACK: the server accepts and confirms it is ready.
3. ACK: the client confirms, and the connection is open.

After that, data is sent in numbered pieces. The receiver confirms what it has received, and the sender resends anything that was not confirmed. TCP also slows itself down when the network is congested.

All of this costs a little time, because of the extra round trips and confirmations.

How TCP keeps order and fixes mistakes

Every TCP segment carries a sequence number. The receiver sends back acknowledgements that say how much data it has received so far.

Sender sends pieces 1, 2, 3, 4, 5
Receiver gets 1, 2, 4, 5 and acknowledges "I have everything up to 2"
Sender notices that 3 was never confirmed and sends it again
Receiver puts 1, 2, 3, 4, 5 in the right order

That is how a file arrives intact even when the network drops pieces on the way.

TCP also does flow control, so a fast sender does not overwhelm a slow receiver, and congestion control, which slows the sender down when the network is crowded. When both sides are done, each one sends a FIN message to close its half of the connection.

UDP: fast and simple

UDP sends small units called datagrams with no handshake, no confirmation and no resending. If a datagram is lost, nothing in UDP notices.

That sounds careless, but it is the right choice when old data is useless. In a live video call, a packet that arrives half a second late cannot be played any more. Waiting for a resend would only make the call stutter, so it is better to drop the packet and keep going.

UDP also has less overhead than TCP, because there is no connection to set up or keep track of.

Which one to use

• TCP when every byte matters: web pages, email, file downloads and SSH logins.
• UDP when speed matters more than perfection: video calls, online games, live streaming and DNS lookups.

A few protocols can use both. DNS normally uses UDP for quick lookups and switches to TCP when an answer is too large for one datagram.

Ports: which program gets the data

An IP address finds the right computer. But one computer runs many programs at once: a browser, a chat app, a game. A port number, from 0 to 65535, tells the computer which program should receive the data.

Some common ports:

• 80 HTTP (web)
• 443 HTTPS (secure web)
• 22 SSH (remote login)
• 53 DNS
• 25 SMTP (sending email)

A full destination is written as an address and a port, for example 203.0.113.5:443: the computer 203.0.113.5 and the program that listens on port 443.

Your side has a port too

A server listens on a well-known port such as 443. Your computer also needs a port for each conversation, so replies reach the right program. It picks a random high number called an ephemeral port, usually between 49152 and 65535.

Tab 1: 192.168.1.23:51234  to  203.0.113.5:443
Tab 2: 192.168.1.23:51235  to  203.0.113.5:443

Both tabs talk to the same server and the same port. The different source ports keep the two conversations apart. A connection is identified by four values together: source IP, source port, destination IP and destination port.

Port numbers fall into three groups:

• 0 to 1023: well-known ports for standard services
• 1024 to 49151: registered ports for specific applications
• 49152 to 65535: dynamic ports your computer picks for itself

See ports on your own machine

ss -tuln        # Linux: listening TCP and UDP ports, numeric
netstat -an     # Windows, macOS and older Linux

In ss -tuln, the letters mean: t TCP, u UDP, l listening only and n show numbers instead of names.

You will probably see a few services already listening, and that is normal. Knowing what is listening on your machine is a basic security habit, because every open port is a place something could connect to.