In this guide
TCP fundamentals
TCP is connection-oriented and presents applications with a reliable, ordered byte stream. Sequence numbers, acknowledgements, retransmission and a receive window allow missing data to be recovered and delivered in order.
TCP does not preserve application message boundaries. If an application sends two writes, the receiver may read them as one or several chunks. Applications that need messages must provide their own framing.
Reliable describes the service TCP provides to the application; it does not mean the application itself is guaranteed to process data successfully.
Connection establishment and teardown
The normal three-way handshake synchronises sequence-number spaces and negotiates options.
- SYN: initiator proposes an initial sequence number and capabilities.
- SYN-ACK: responder acknowledges it and supplies its own sequence number.
- ACK: initiator acknowledges the responder.
Important states include LISTEN, SYN-SENT, SYN-RECEIVED, ESTABLISHED, FIN-WAIT, CLOSE-WAIT, TIME-WAIT and CLOSED. FIN exchanges close the two directions independently. A TCP RST is an abort rather than an orderly close.
Flow and congestion control
Do not confuse flow control with congestion control. Flow control protects the receiver: the advertised receive window limits outstanding data. Congestion control protects the network: the congestion window limits how much data the sender should inject based on observed conditions.
The effective amount of outstanding data is constrained by both windows. Modern implementations use mechanisms including slow start and congestion avoidance and can react to loss, delay and ECN where supported. Retransmission timers and fast retransmit help recover from loss.
TCP options
- MSS: advertises the largest TCP payload an endpoint is prepared to receive. 1460 bytes is common with a 1500-byte IPv4 MTU and normal headers.
- Window scaling: extends the receive-window range for high-bandwidth/high-latency paths.
- SACK: reports non-contiguous blocks that arrived successfully.
- Timestamps: support RTT measurement and protection against old duplicate segments.
- ECN: can signal congestion without relying solely on packet loss when the path supports it.
- TCP Fast Open: can permit data during connection establishment where supported.
UDP
UDP is connectionless and preserves application datagram boundaries. It has no TCP-style handshake, retransmission, sequencing or congestion-control mechanism built into UDP itself.
UDP still provides a checksum for error detection. For IPv4, a zero UDP checksum is permitted in specified circumstances; for IPv6, UDP checksums are required except for narrowly defined exceptions.
Applications can build reliability, ordering, rate control or retransmission above UDP. DNS, DHCP, streaming, real-time media and many discovery protocols use UDP for reasons including low overhead and message-oriented operation.
QUIC and HTTP/3
QUIC runs over UDP but provides connection-oriented transport features such as reliable streams, congestion control, encryption and connection migration. HTTP/3 uses QUIC rather than TCP.
QUIC also avoids some TCP head-of-line blocking characteristics by multiplexing independent streams. This is why UDP is not synonymous with an unreliable application: the protocol above UDP can provide substantial transport functionality.
Choosing TCP or UDP
| Requirement | Typical choice | Reason |
|---|---|---|
| Reliable ordered file transfer | TCP | Built-in reliability and ordering |
| Simple request/response datagrams | UDP | Message boundaries and low overhead |
| Real-time media | UDP / RTP or QUIC-based designs | Application can manage timing and loss |
| Modern web transport | TCP or QUIC | HTTP/2 commonly uses TCP; HTTP/3 uses QUIC |
Troubleshooting
- Confirm expected protocol, source/destination address and port.
- For TCP, inspect SYN/SYN-ACK/ACK, resets, retransmissions, duplicate ACKs, windows and RTT.
- Check whether loss is occurring on access, WLAN, WAN or server paths.
- For UDP, determine whether loss or reordering is handled by the application.
- For QUIC, inspect UDP/443 and QUIC connection behaviour rather than expecting a TCP handshake.
- Check MTU and firewall state when handshakes succeed but application traffic stalls.
Standards
- RFC 9293 — Transmission Control Protocol.
- RFC 768 — User Datagram Protocol.
- RFC 9000 — QUIC.
- RFC 9114 — HTTP/3.
Key takeaways
TCP gives applications a reliable ordered stream and actively manages receiver and network constraints. UDP supplies simple datagrams. QUIC demonstrates how rich transport behaviour can be implemented above UDP.