TCP vs UDP: When Each Is Used

TCP and UDP are the two main protocols at the transport layer (OSI Layer 4). They define how data is sent between applications on different hosts.

TCP is a connection-oriented protocol. Before data is sent, a connection is established via the three-way handshake. TCP guarantees delivery, ordering, and error checking.

Use cases: HTTP/HTTPS, SSH, SMTP, FTP — any application that needs reliability.

TCP connection establishment:

1. Client sends SYN (synchronize)
2. Server replies with SYN-ACK (synchronize-acknowledge)
3. Client sends ACK (acknowledge)

Connection is now established. This handshake is the target of SYN flood attacks.

TCP provides:

• Reliability — retransmits lost packets
• Ordering — reassembles packets in correct sequence
• Flow control — prevents overwhelming the receiver
• Congestion control — adapts to network capacity

UDP is a connectionless protocol. It sends datagrams without establishing a connection first. No guaranteed delivery, no ordering, no acknowledgment.

Use cases: DNS, VoIP, video streaming, online gaming, DHCP — applications where speed matters more than perfection.

UDP is fast and lightweight:

• No connection overhead
• No retransmission delays
• Lower latency
• Application must handle reliability if needed (e.g., QUIC over UDP)

Key differences:

• TCP: reliable, ordered, slower, connection-oriented
• UDP: fast, unreliable, connectionless, lower overhead

QUIC (HTTP/3) uses UDP with custom reliability for modern web performance.

TCP's handshake creates security exposure:

• SYN flood: attacker sends thousands of SYN packets without completing handshakes, exhausting server resources
• TCP session hijacking: attacker predicts sequence numbers to inject data into an existing session

UDP's lack of connection state enables:

• UDP amplification DDoS: attacker spoofs victim's IP, sends small requests to open UDP services that send large responses back to victim
• DNS amplification: a single small DNS request can trigger a much larger response

Key ports to know:

• TCP 22 — SSH
• TCP 80 — HTTP
• TCP 443 — HTTPS
• UDP 53 — DNS
• UDP 67/68 — DHCP
• TCP 3306 — MySQL
• TCP 3389 — RDP

Use ss or netstat to inspect open ports and connections:

A DNS query is sent from your computer to resolve a domain name. Which protocol does it use?

TCP provides reliable, ordered delivery using a three-way handshake — ideal for HTTP, SSH, and SMTP. UDP is fast and connectionless — ideal for DNS, VoIP, and streaming. Each has distinct security implications: TCP is vulnerable to SYN floods and session hijacking; UDP enables amplification attacks.