Networking Concepts · Topic 5 of 11
IP Protocol Types and Traffic Types
Compare TCP, UDP, ICMP, GRE and IPsec protocol types and the unicast, multicast, anycast and broadcast traffic types used on IP networks for Network+.
- 4 min
- Protocol numbers: ICMP is 1, TCP is 6, UDP is 17, GRE is 47, ESP is 50, AH is 51.
- TCP is reliable and connection oriented, and it uses the SYN, SYN-ACK, ACK handshake.
- UDP is connectionless and faster, which suits voice, video and DNS queries.
What it is
Every Internet Protocol (IP) packet carries a protocol number in its header. The number tells the receiver which protocol is inside, for example the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP) or the Internet Control Message Protocol (ICMP).
Traffic type describes how many receivers a packet is meant for: one, a group, the nearest of several, or everyone on the network. Both ideas appear on the exam.
How it works
Protocol types
| Protocol | IP protocol number | Purpose |
|---|---|---|
| ICMP | 1 | Error messages and tests such as ping |
| TCP | 6 | Reliable, ordered, connection oriented delivery |
| UDP | 17 | Fast, connectionless, no delivery guarantee |
| Generic Routing Encapsulation (GRE) | 47 | Tunnels many kinds of traffic inside IP |
| Encapsulating Security Payload (ESP) | 50 | IPsec encryption and integrity |
| Authentication Header (AH) | 51 | IPsec integrity and authentication without encryption |
The Internet Protocol Security (IPsec) suite protects IP traffic. ESP can encrypt the payload, while AH only authenticates it. The Internet Key Exchange (IKE) negotiates the keys and uses UDP port 500.
TCP and UDP compared
TCP starts with a three way handshake: SYN (synchronize), SYN-ACK (synchronize and acknowledge), then ACK (acknowledge). It numbers data, retransmits what is lost and controls the flow, so it suits web pages, email and file transfers.
UDP has no handshake and no retransmission. It suits traffic where speed matters more than perfection, such as voice, video streaming and Domain Name System (DNS) queries.
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection oriented | Connectionless |
| Reliability | Acknowledgements and retransmission | None |
| Overhead | Higher | Lower |
| Typical use | Web browsing, remote shell sessions, email | Name lookups, address assignment, voice, time sync |
ICMP and tunneling
ICMP carries control messages. Echo request and echo reply are used by ping, and Time Exceeded and Destination Unreachable report problems. ICMP has no port numbers because it is not a transport protocol.
GRE wraps one packet inside another so it can cross a network that does not know the inner protocol. GRE alone does not encrypt, so it is often paired with IPsec.
Traffic types
| Type | Delivered to | Example |
|---|---|---|
| Unicast | One specific host | A browser talking to a web server |
| Multicast | A group of interested hosts | Video distribution or routing protocol updates |
| Anycast | The nearest of several hosts sharing one address | Public DNS services and content delivery |
| Broadcast | Every host on the local network | Address Resolution Protocol (ARP) requests |
A broadcast stays inside its broadcast domain. Routers do not forward it, and virtual local area networks (VLANs) are used to shrink the domain.
Multicast uses special addresses from 224.0.0.0 to 239.255.255.255 in IPv4 (Internet Protocol version 4). Hosts join a group with the Internet Group Management Protocol (IGMP), so only interested receivers get the traffic.
In IPv4 the limited broadcast address is 255.255.255.255, and the directed broadcast is the last address of a subnet. IPv6 (Internet Protocol version 6) has no broadcast. It uses multicast instead.
What to remember for the exam
- Protocol numbers: ICMP is 1, TCP is 6, UDP is 17, GRE is 47, ESP is 50, AH is 51.
- TCP is reliable and connection oriented, and it uses the SYN, SYN-ACK, ACK handshake.
- UDP is connectionless and faster, which suits voice, video and DNS queries.
- ICMP is used by ping and traceroute and has no port numbers.
- GRE tunnels traffic but does not encrypt. IPsec ESP provides encryption.
- Unicast is one to one, multicast is one to a group, broadcast is one to all, and anycast is one to the nearest.
- IPv4 multicast addresses run from 224.0.0.0 to 239.255.255.255.
- IPv6 does not use broadcast.
Think of anycast as "nearest of many". Several servers advertise the same address, and routing delivers each client to the closest one.
Common mistakes
Calling ICMP a TCP or UDP service. ICMP is its own IP protocol and uses no ports, even though ping seems to behave like a connection.
Assuming UDP is always worse. It has no recovery, but it avoids delay, so it is the right choice for real time voice and video.
Mixing multicast and broadcast. Broadcast goes to everyone in the domain. Multicast goes only to hosts that joined the group.
Thinking GRE secures traffic. GRE only encapsulates. Add IPsec when confidentiality is needed.
Mixing AH and ESP. AH authenticates but does not encrypt, while ESP can do both.
Do not choose broadcast for a design that needs to reach a few hosts across routers. Routers block broadcasts, so use multicast or unicast instead.
Check yourself
Work through these three questions.
Which transport protocol suits a voice call, and why?
UDP, because it avoids the delay of retransmission and handshakes.
What is the difference between multicast and anycast?
Multicast delivers to every member of a group, while anycast delivers to the nearest one of several hosts that share an address.
Which IPsec protocol provides encryption?
Encapsulating Security Payload (ESP), IP protocol number 50.
Topic 5 of 11 in Networking Concepts
Test yourself on Networking Concepts
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.