INHow the Internet Works · Lesson 4 of 7

TCP & UDP — Reliable vs Fast

IP delivers packets 'best effort' — they can vanish, duplicate, or arrive shuffled. TCP builds reliability on top of that chaos. UDP skips the ceremony for speed. Every connection chooses one.

Text

TCP opens with a handshake (one round trip):

  you  --- SYN ------->  server    "want to talk, seq=X"
  you  <-- SYN-ACK ----  server    "sure, seq=Y, got X"
  you  --- ACK ------->  server    "got Y — we're on"

Then every byte is numbered:
  - receiver ACKs what arrived
  - sender retransmits anything unACKed (loss!)
  - sequence numbers let receiver reorder & dedupe
  - flow control: receiver says how much it can take
  - congestion control: sender probes how fast the
    NETWORK can take it, backs off when loss appears

Result: a reliable byte stream over an unreliable network.

Ports let one machine hold many conversations: a connection is the 4-tuple (source IP, source port, destination IP, destination port). Servers listen on well-known ports — 443 HTTPS, 80 HTTP, 22 SSH, 53 DNS — while your side uses a random high port per connection. A 'connection refused' means the machine answered but nothing was listening on that port.

Bash

# See your machine's TCP conversations right now:
netstat -an | head -20      # (or: ss -t on Linux)
# ESTABLISHED = active   LISTEN = server waiting

# UDP: no handshake, no ACKs, no retransmit, no order.
# Just 'fling the packet'. Perfect when late data is
# worthless — a lost frame of a video call shouldn't
# be replayed 2 seconds later.
#   DNS queries    UDP (tiny, just re-ask on loss)
#   video calls    UDP (skip the glitch, keep going)
#   games          UDP (old positions are useless)
#   web, email     TCP (every byte must arrive)

◆ Note
HTTP/3 runs on QUIC — reliability rebuilt on top of UDP, with encryption baked in and the handshake merged into TLS's. Why abandon TCP? Head-of-line blocking: one lost TCP packet stalls every request sharing the connection. QUIC keeps streams independent, so one loss delays only its own stream. About a third of web traffic already rides it.