English
Menu

TCP vs UDP: Connection Setup, Reliability, Ordering, Congestion Control, Header Size, Latency and Uses

TCP and UDP are both transport-layer protocols that run on top of IP and use port numbers to identify applications. Before sending data, TCP establishes a connection with a three-way handshake; it confirms delivery with acknowledgments (ACKs), retransmits lost data and hands data to the receiving application in the order it was sent. It also adjusts how much it sends to the receiver's free buffer space (flow control) and to network congestion (congestion control). UDP does none of this: it simply sends data as datagrams, so its header is small and there is no wait before sending. Use TCP when reliable delivery matters, and UDP when low delay matters and the application handles whatever else it needs.

AspectTCPUDP
Connection setupConnection-oriented: data follows a three-way handshake (SYN → SYN+ACK → ACK), so there is an initial wait of one round trip (RTT)Connectionless: data can be sent immediately, with no setup
Acknowledgment and retransmissionDelivery is confirmed with ACKs; loss is detected by a retransmission timeout or duplicate ACKs, and the lost data is resentNo acknowledgment or retransmission; lost data stays lost
OrderingSequence numbers are used to reorder data and deliver it in the order it was sent; duplicates are removedData is delivered in arrival order; reordering and duplication can occur
Data boundariesA byte stream with no boundaries; the application decides where messages begin and endEach send becomes one datagram, so message boundaries are preserved
Flow and congestion controlYes: the receive window keeps the receiver's buffer from overflowing, and the congestion window adapts the amount sent to congestionNone; if needed, the application adjusts its own sending rate
Header size20 bytes without options (up to 60 bytes with options)8 bytes (source and destination ports, length, checksum)
LatencyConnection setup costs one round trip; after a loss, later data also waits until the retransmission arrivesNo setup and no waiting for retransmissions, so delay is low, but some data may be missing
Destination typesOne-to-one (unicast) onlyUnicast, and also broadcast and multicast
Typical usesThe web over HTTP/1.1 and HTTP/2, video delivery over HTTP, email (SMTP), SSH, file transferDNS queries, DHCP, real-time traffic such as voice calls and live video, online games, and QUIC used by HTTP/3

Figures are typical orders of magnitude and vary by process generation and product.

When to use which

TCP
When missing or reordered data would be a problem. It is the default for most applications: web pages, files, email, database connections and more.
UDP
For real-time traffic where it is better to lose a little than to arrive late, and for short exchanges that need just one query and one response. It is also used for broadcast and multicast, and when the application builds its own reliability, as QUIC does.

FAQ

Since UDP is unreliable, should it be avoided?

It depends on the purpose. What UDP leaves out is delivery confirmation and retransmission, ordering and rate adjustment. When these are not needed, or the application wants to handle them in its own way, UDP is a good fit. In a voice call, for example, sound that arrives late is useless, so moving on is better than waiting for a retransmission. Applications that send large amounts of data over UDP must, however, control their own sending rate so as not to congest the network.

Why is QUIC built on top of UDP?

QUIC (RFC 9000) is a transport protocol that combines retransmission, ordering, congestion control and TLS 1.3 encryption. A brand-new protocol carried directly over IP often fails to pass NATs and firewalls along the path, and would also have to wait for operating system support. Building on UDP lets it pass through existing networks and be implemented and updated in the application. HTTP/3 runs over QUIC.

Does DNS use only UDP?

Ordinary name queries use UDP port 53 and are done with a single query and response. When a response is too large to send over UDP, and for zone transfers, TCP is used, and DNS implementations are required to support TCP as well (RFC 7766).

How do TCP flow control and congestion control differ?

Flow control keeps the receiver's buffer from overflowing: the receiver advertises its free space as the receive window. Congestion control keeps the network along the path from being overloaded: the sender infers congestion from packet loss and similar signs and grows or shrinks its congestion window. The amount that can actually be sent is set by the smaller of the two windows.

Check your understanding

In the four-layer TCP/IP model, which layer do TCP and UDP belong to?

  1. AApplication layer
  2. BInternet layer
  3. CTransport layer
Show answer and explanation

Answer: C. Transport layer

The TCP/IP model is described with four layers, from the bottom: the link layer (network interface layer), the internet layer, the transport layer and the application layer. TCP and UDP are transport-layer protocols, and they use port numbers to tell which application on a host the traffic is for. IP, in the internet layer, is responsible for delivering packets from one host to another. HTTP and DNS are application-layer protocols. Mapped onto the OSI reference model, the transport layer corresponds to layer 4 and the internet layer to layer 3.

Which correctly describes UDP?

  1. AIt does not establish a connection or control retransmission and ordering, so its header is small and there is no wait before sending
  2. BIt establishes a connection, retransmits data that did not arrive and puts data back in order at the receiver
  3. CIt delivers data to the destination host using only MAC addresses, without IP addresses
Show answer and explanation

Answer: A. It does not establish a connection or control retransmission and ordering, so its header is small and there is no wait before sending

UDP is a lightweight protocol that adds only port numbers and a simple error check (checksum) on top of IP; its header is 8 bytes (TCP's is 20 bytes without options). With no connection setup, no delivery confirmation and no retransmission, it is used for voice calls and live video, where a little loss is better than delay, and for DNS, which needs just one query and one response. If reliability is needed, the application provides it; QUIC, used by HTTP/3, implements retransmission and encryption on top of UDP. Connection setup, retransmission and ordering are what TCP does.

In the three-way handshake that establishes a TCP connection, what is the correct order of the packets exchanged?

  1. ASYN → ACK → FIN
  2. BACK → SYN → SYN+ACK
  3. CSYN → SYN+ACK → ACK
Show answer and explanation

Answer: C. SYN → SYN+ACK → ACK

In the three-way handshake, the client first requests a connection with a SYN and announces the first number of the data it will send (its initial sequence number). The server replies with a SYN+ACK, acknowledging (ACK) that and announcing its own initial sequence number. Finally the client returns an ACK, and both directions are ready. Confirming the numbers in both directions in three exchanges prevents mistaken connections, for example from old packets that arrive late. As a result, TCP needs at least one round-trip time (RTT) before data can start flowing. FIN is used to close a connection.

  1. In TCP flow control, what is the purpose of the receiver advertising its window size (receive window) to the sender?
  2. Which correctly describes the basic idea of TCP congestion control?
  3. What triggers a TCP sender to decide that a segment was lost and retransmit it?

Practice Computer Networking Basics questions

Key terms explained

Three-way handshake
The procedure that establishes a TCP connection. Three exchanges, the client's SYN, the server's SYN+ACK and the client's ACK, confirm each side's initial sequence number.
Port number
A number from 0 to 65535 used by TCP and UDP to identify which application on a host the traffic is for. Ports 0–1023, such as 80 for HTTP, 443 for HTTPS and 53 for DNS, are called well-known ports.
OSI reference model
A model that organizes communication functions into seven layers: physical, data link, network, transport, session, presentation and application. It serves as a common vocabulary for thinking about each layer's role separately.
DNS (Domain Name System)
A system, managed in a distributed way by servers around the world, that maps domain names such as www.example.com to the IP addresses used for communication.
DHCP
Dynamic Host Configuration Protocol. A protocol that automatically assigns devices joining a network an IP address, subnet mask, default gateway, DNS servers and other settings for a limited time.
TLS
Transport Layer Security. A protocol that encrypts communication, detects tampering and authenticates servers with certificates. HTTPS is HTTP protected by TLS.
HTTP (Hypertext Transfer Protocol)
The application-layer protocol for exchanging HTML, images and data between web browsers and web servers, among others. A client sends a request made up of a method, a URL, headers and a body, and the server returns a response made up of a status code, headers and a body. As a protocol it is stateless, so state such as a login is kept with cookies and similar means. HTTP/1.1 uses a text format and persistent connections, HTTP/2 multiplexes several streams over one TCP connection, and HTTP/3 runs over QUIC on UDP. HTTP protected by TLS is called HTTPS.

Related comparisons