Network Fundamentals · Topic 5 of 17
Comparing TCP and UDP
Compare TCP and UDP, including the three-way handshake, reliability, windowing, headers, port numbers and which applications use each transport protocol.
- 5 min
- Exam objective 1.5
- TCP is connection-oriented and reliable. UDP is connectionless and best-effort.
- The TCP three-way handshake is SYN, SYN-ACK, ACK.
- TCP uses sequence numbers, acknowledgements and windowing.
What it is
TCP and UDP are the two main Layer 4 protocols, and they make opposite trade-offs.
They sit above IP and deliver data between applications on different hosts, using port numbers. An IP address identifies a host, and a port number identifies the application on that host.
TCP is careful and reliable, but it carries extra overhead. UDP is fast and light, but it makes no promises.
How it works
TCP builds a managed connection first, while UDP just sends.
TCP
TCP is connection-oriented. Before any data is sent, the two hosts set up a connection using a three way handshake.
- The client sends a SYN.
- The server replies with a SYN-ACK.
- The client sends an ACK.
After that, data flows. TCP gives several features:
- Reliability: each segment gets a sequence number, and the receiver sends acknowledgements. If an acknowledgement does not arrive, the sender retransmits the data.
- Ordering: the receiver puts segments back in order even if they arrived out of order.
- Flow control: a window tells the sender how much data the receiver can accept before it must wait for an acknowledgement. The window size can change during the transfer.
- Error checking: a checksum detects damaged segments.
- Orderly close: the connection ends with a FIN exchange, or is cut immediately with a RST.
The cost is overhead. The TCP header is at least 20 bytes, and the handshake, acknowledgements and retransmissions all take time and bandwidth.
The handshake order is SYN, then SYN-ACK from the server, then ACK from the client. The client never starts with ACK.
UDP
UDP is connectionless. There is no handshake, and the sender simply sends datagrams.
UDP does not number the data, does not wait for acknowledgements and does not retransmit. The header is only 8 bytes.
This makes UDP fast and low in overhead. If a datagram is lost, UDP does not notice, so an application that cares must deal with the loss itself.
UDP suits traffic where speed matters more than perfection, or where one small question and one small answer is all that is needed.
Voice and video calls cannot wait for a retransmitted packet, because by the time it arrives it is too late to be useful. DNS queries are tiny, so a quick exchange is better than a full connection.
Side by side
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented | Connectionless |
| Handshake | Three-way | None |
| Reliability | Acknowledgements and retransmission | None |
| Ordering | Yes | No |
| Flow control | Windowing | None |
| Header size | 20 bytes minimum | 8 bytes |
| Typical uses | Web, email, file transfer, remote login | Voice, video, DNS, DHCP, NTP, SNMP |
Port numbers
Ports are 16-bit numbers from 0 to 65535. They fall into three ranges:
- Well-known ports: 0 to 1023, assigned to common services.
- Registered ports: 1024 to 49151.
- Dynamic or ephemeral ports: 49152 to 65535, picked by a client for the source of a connection.
When a client connects to a web server, the destination port is 80 or 443, and the source port is a random one chosen from the dynamic range.
The combination of source address, source port, destination address and destination port identifies one conversation.
Some ports are worth knowing:
- TCP: FTP 20 and 21, SSH 22, Telnet 23, SMTP 25, HTTP 80, HTTPS 443.
- UDP: DHCP 67 and 68, TFTP 69, NTP 123, SNMP 161 and 162, syslog 514.
- Both TCP and UDP: DNS 53, which uses UDP for most queries and TCP for large responses and zone transfers.
You can see current connections on a Cisco device with show tcp brief, and on a computer with netstat.
What to remember for the exam
Eight facts cover this objective.
- TCP is connection-oriented and reliable. UDP is connectionless and best-effort.
- The TCP three-way handshake is SYN, SYN-ACK, ACK.
- TCP uses sequence numbers, acknowledgements and windowing.
- The TCP header is at least 20 bytes. The UDP header is 8 bytes.
- UDP is chosen for real-time traffic and short exchanges.
- Well-known ports are 0 to 1023. Dynamic ports are 49152 to 65535.
- DNS uses port 53 on both UDP and TCP.
- A port number identifies an application. An IP address identifies a host.
If late data is useless, such as a voice call, think UDP. If every byte must arrive in order, think TCP.
Common mistakes
These five ideas are often confused.
Saying UDP is "unreliable" as if it were bad. It is a design choice. The application can trade reliability for speed.
Forgetting that windowing is flow control. The window controls how much data may be outstanding. It is not the same as error checking.
Mixing up the handshake order. The server answers with SYN-ACK, and the client finishes with ACK. The client does not start with ACK.
Thinking a port number identifies a host. It identifies the service on a host. Hosts are identified by IP addresses.
Assuming each protocol uses only one transport. DNS uses both. Pick UDP for ordinary lookups and TCP for large responses.
Check yourself
Work through these three prompts.
Why is a voice call better served by UDP than by TCP?
Voice cannot wait for a retransmitted packet, because by the time it arrives it is too late to be useful. UDP does not retransmit and has low overhead.
What are the three steps of the TCP handshake?
The client sends a SYN, the server replies with a SYN-ACK, and the client sends an ACK. The client never starts with ACK.
How does the source port a client uses compare with the destination port a server uses?
The client picks a random source port from the dynamic range, 49152 to 65535. The server's destination port is a well-known one, such as 80 or 443 for a web server.
Topic 5 of 17 in Network Fundamentals
Test yourself on Network Fundamentals
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.