Standards and Concepts · Topic 5 of 6
TCP and UDP, Connection-Oriented and Connectionless
Compare TCP and UDP, learn what connection oriented and connectionless mean, how the three way handshake works and when each protocol is used.
- 4 min
- Includes a diagram
- TCP is connection oriented and reliable. UDP is connectionless and gives no delivery guarantee.
- TCP opens a connection with a three way handshake of SYN, SYN and ACK, and ACK.
- TCP uses sequence numbers and acknowledgements to resend lost data and keep order.
What it is
TCP and UDP are the two transport protocols that carry data between programs on different devices.
They work at layer 4. Both use port numbers to find the right program, but they treat delivery very differently.
TCP is connection oriented and reliable. UDP is connectionless and fast, but it gives no promise of delivery.
How it works
TCP adds extra steps to guarantee delivery, while UDP skips them to save time.
TCP, connection oriented
TCP sets up a connection before any data is sent. It then tracks the data and fixes problems.
The setup is called the three way handshake:
- The client sends a SYN message to ask for a connection.
- The server replies with SYN and ACK to agree.
- The client sends an ACK, and the connection is open.
Once it is open, TCP does several jobs:
- It numbers the segments, so they can be put back in order.
- The receiver sends acknowledgements, and missing data is sent again.
- It controls the flow, so a fast sender does not swamp a slow receiver.
- It closes the connection politely when finished.
All of this adds overhead. TCP headers are larger, and there is more traffic.
UDP, connectionless
UDP just sends each message, called a datagram, without setting up a connection. There is no numbering, no acknowledgement and no resending.
Because it does little, it has less delay and a small header. If a datagram is lost, UDP does not notice. The application has to cope.
Where each one fits
Many everyday services are built on one of the two. Web browsing, email and file transfer need every byte, so they use TCP. Streaming, voice calls and many online games use UDP, because late data is no use.
A few services use both. DNS normally uses UDP for a short question and answer, because setting up a connection would cost more than the exchange itself.
Comparing the two
| Point | TCP | UDP |
|---|---|---|
| Connection | Connection oriented | Connectionless |
| Delivery | Reliable, with acknowledgements | Best effort, no guarantee |
| Order | Segments put back in order | No ordering |
| Speed and overhead | Slower, more overhead | Faster, less overhead |
| Typical use | Web pages, email, file transfer | Voice, video streaming, DNS queries |
Choose by the need. Remember that a web page that arrives with missing pieces is useless, so it uses TCP. A voice call is better with a tiny gap than with a long wait for resent data, so it uses UDP.
Port numbers
A port number is a 16 bit value that identifies the program. Servers listen on well known ports, and clients pick a temporary port.
The well known ports are the ones from 0 to 1023. A server address and port together are often written as 192.168.1.10:443.
What to remember for the exam
Six facts cover most questions on this topic.
- TCP is connection oriented and reliable. UDP is connectionless and gives no delivery guarantee.
- TCP opens a connection with a three way handshake of SYN, SYN and ACK, and ACK.
- TCP uses sequence numbers and acknowledgements to resend lost data and keep order.
- UDP has lower overhead and delay, so real time traffic often uses it.
- Both protocols work at layer 4 and use port numbers.
- Well known ports are in the range 0 to 1023.
Reliable and ordered points to TCP. Fast with low overhead points to UDP.
Common mistakes
These four errors appear again and again.
Saying UDP is bad. UDP is the right choice for traffic where speed matters more than perfect delivery.
Thinking TCP guarantees speed. It guarantees delivery, and the extra steps make it slower than UDP.
Forgetting that ports belong to layer 4. A port number is not an IP address, and it does not identify a device.
Mixing up the handshake order. It is SYN, then SYN and ACK, then ACK.
Connectionless does not mean the data is sent without an address. Each UDP datagram still has an IP address and a port number.
Check yourself
Work through these three questions.
What are the three steps of the TCP handshake?
The client sends SYN, the server replies with SYN and ACK, and the client sends ACK.
Why might a video call use UDP instead of TCP?
UDP has less delay and overhead. A small loss is better than waiting for lost data to be resent.
What does connectionless mean?
It means no connection is set up first, and each message is sent on its own with no acknowledgement.
Topic 5 of 6 in Standards and Concepts
Test yourself on Standards and Concepts
The full Cisco CCST 100-150 Networking question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.