Difference Between TCP and UDP

There are two types of internet protocol (IP) traffic, and both have very different uses.

TCP

1. TCP(Transmission Control Protocol). TCP is a connection-oriented protocol, a connection can be made from client to server, and from then on any data can be sent along that connection.

        Reliable - when you send a message along a TCP socket, you know it will get there unless the connection fails completely. If it gets lost along the way, the server will re-request the lost part. This means complete integrity, things don't get corrupted.

       Ordered - if you send two messages along a connection, one after the other, you know the first message will get there first. You don't have to worry about data arriving in the wrong order.

      Heavyweight - when the low level parts of the TCP "stream" arrive in the wrong order, resend requests have to be sent, and all the out of sequence parts have to be put back together, so requires a bit of work to piece together.

UDP
 
2. UDP(User Datagram Protocol). A simpler message-based connectionless protocol. With UDP you send messages(packets) across the network in chunks.

    Unreliable - When you send a message, you don't know if it'll get there, it could get lost on the way.

    Not ordered - If you send two messages out, you don't know what order they'll arrive in.

   Lightweight - No ordering of messages, no tracking connections, etc. It's just fire and forget! This means it's a lot quicker, and the network card / OS have to do very little work to translate the data back from the packets.

  Faster than TCP

The TCP 3-Way-Handshake

Each and every communication through  TCP starts with a procedure called three-way-handshake. 

Here client is shown as active participant and server is shown as passive participant because client initiates (active) a connection to a server which waits (passive)  for connetions on a particular port.

The three-way handshake is done in the following process:-

1. The client sends a SYN packet to the server indicating

that it wants to set a TCP connection.It also sends ISN (Initial Sequenc Number). Here ISN is x.

2. If the server is 'alive' and listening on the requested

 port and can accept an incoming connection, it replies with its own SYN + ACK packet. It sends its own ISN (Initial Sequence Number)(for this connection, y ) and acknowledges the clients request by sending back client's ISN + 1 sequence number (x + 1).

3. Finally, after receiving the server's SYN + ACK

response, the client sends back an ACK packet with a sequence number of server's ISN + 1 (y + 1).

 

This triggers an "OPEN" connection allowing communication b/w the source and destination, until either of them issues a "FIN" packet or a "RST" packet to close the connection.

# tcpdump -n -S -t

Here, -n don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

 

-S print absolute, rather than relative, TCP sequence numbers.

-t don't print timestamp.

    

192.168.1.12.1051 > 192.168.1.11.23: S 4255483971:4255483971(0)

win 65535  (DF)

192.168.1.11.23 > 192.168.1.12.1051: S 4279842714:4279842714(0

ack 4255483972 win 32120  (DF)

192.168.1.12.1051 > 192.168.1.11.23: . ack 4279842715 win 65535 (DF)

1. First line: someone on client (192.168.1.12) is connecting to port 23 (telnet) of server (192.168.1.11). We can see that SYN flag is set (S), followed by:

   4255483971:4255483971(0)

Here, 4255483971(=x) is the ISN (Initial Sequence Number) and it apears twice separated by ':' because there's no payload (0 in parentheses indicates this).

win 65535 indicates that the client has a buffer that can hold 65535 bytes.

mss 1460 indicates that the network on which the client exists can accept a maximum of 1460 bytes payload in a single packet. mss stands for maximum segment size .

<DF> requests that the packet shouldn't be fragmented.

Interesting fact: though the client has a buffer that can accept 65535 bytes of data, the network cannot accept more than 1460 bytes of payload. 

2. Second line: server replies with a SYN and ACK flagged packet. It also sends its ISN (4279842714=y) and acknowledge number (clinet's ISN + 1 = 4255483972). Server's window size is 32120 and maximum segment size is 1460. 

3. Third line: client sends back acknowledgement packet with a sequence number of 4279842715 (server's ISN + 1 = 4279842715).

Note that this packet has no flag set (`.' indicates that no flags were set).