TCP vs UDP: Key Differences Explained with Examples

TCP implements sliding window using sender and receiver buffers: receiver buffer contains data ready for application (green) and out-of-order data (red) requiring retransmission; sender buffer contains unacknowledged data (green) and data not yet sent (red). Flow control prevents receiver buffer overflow using advertised window: receiver sends buffer capacity in each ACK, sender adjusts transmission rate accordingly. Congestion control prevents network overload by limiting total transmission rate across all flows sharing network resources. These mechanisms ensure reliable and efficient data transmission over unreliable networks.

TCP flow control prevents overwhelming receivers using a window field where receivers tell senders how much data they can receive. TCP congestion control manages network capacity by adjusting transmission rates based on network conditions. The window size is the minimum of flow control window (receiver's buffer) and congestion window (network capacity). TCP uses Slow Start where window grows exponentially (doubling each RTT) to quickly utilize bandwidth. TCP assumes packet loss indicates congestion and responds by reducing transmission rates. TCP detects loss through duplicate acknowledgments (three duplicates trigger retransmission) and retransmission timeouts. TCP uses AIMD (Additive Increase Multiplicative Decrease) algorithm: add one MSS per successful RTT, divide by two when packet loss detected. TCP calculates window size as minimum of receiver's buffer capacity and network capacity. TCP starts with small initial window (1 MSS) to probe network capacity. TCP measures RTT using exponential weighted moving average with smoothing factor α=0.125. TCP Fast Retransmit triggers retransmission when three duplicate acknowledgments are received. TCP Fast Recovery reduces window size by half and adds one MSS for each duplicate acknowledgment, allowing higher transmission rates during recovery.

TCP implements flow control using the sliding window protocol to prevent overwhelming receivers with excessive data, which could cause packet loss and congestion. The sender includes window sizes in headers indicating receiver capacity, and receivers update these values as they process data. For congestion control, TCP uses the Additive Increase Multiplicative Decrease (AIMD) algorithm: it exponentially increases send rate until packet loss is detected, then halves the rate (multiplicative decrease), and gradually increases it again (additive increase). These mechanisms ensure efficient network utilization while preventing congestion-related performance degradation.

TCP flow control uses advertised window to match sending rate with receiver's buffer capacity. The effective window is the minimum of sender's calculated window and receiver's advertised window. Congestion control adjusts sending rate to prevent network overload. TCP uses sliding window protocol for efficient flow control, with effective window being the minimum of sender's calculated window and receiver's advertised window. This ensures data transmission rate matches both receiver's processing capability and network capacity. The congestion window (cwnd) limits data in flight, and TCP uses additive increase and multiplicative decrease to find optimal transmission rate.

TCP uses two fundamental mechanisms: Flow Control (protects receiver's buffer using RWND) and Congestion Control (protects network capacity using CWND). Flow Control: During handshake, both parties exchange RWND values (e.g., client 64KB, server 128KB). During transmission, sender checks RWND before sending. If receiver's buffer is nearly full, ACK advertises reduced RWND. When buffer space becomes available, receiver sends window update. Developers cannot directly control RWND (handled by OS kernel) but can influence it via SO_RCVBUF socket option. Congestion Control: CWND starts small and grows exponentially with each ACK (10KB → 20KB → 40KB). When packet loss occurs, CWND halves (160KB → 80KB), preventing further congestion.

The application layer contains protocols you interact with daily. Web browsers use HTTP and HTTPS for web browsing. Email clients use SMTP or IMAP for email communication. File transfers use FTP, and domain lookups use DNS. These application protocols don't directly deal with routing or reliability; they simply produce data and pass it to the layer below. The TL;DR is that this is where user-facing protocols live—HTTP, FTP, SMTP, DNS—generating and consuming data. These protocols almost always use TCP underneath to guarantee reliability, except for some DNS queries and real-time apps that use UDP.

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are transport layer protocols with key differences. TCP is connection-oriented, guarantees packet delivery, and uses a three-way handshake before transmitting data. TCP only supports unicast communication (one-to-one). UDP is connectionless, does not guarantee delivery, and supports unicast, multicast, and broadcast communication. Services requiring reliable delivery (HTTP, SMTP, FTP, Telnet) use TCP, while services requiring speed or broadcast capability (DHCP, DNS queries) use UDP. The Application layer hosts common network services including HTTP for web browsing, SMTP for email sending, POP/IMAP for email receiving, FTP for file transfer, and Telnet for remote access.

Different Application Layer protocols use different Transport Layer protocols based on their requirements. TCP-based protocols requiring reliable delivery include FTP (ports 20/21), SSH (port 22), Telnet (port 23), SMTP (port 25), HTTP (port 80), POP3 (port 110), and HTTPS (port 443). UDP-based protocols prioritizing speed include DHCP (ports 67/68), TFTP (port 69), SNMP (ports 161/162), and Syslog (port 514). Understanding these associations helps in network troubleshooting, firewall configuration, and identifying network traffic patterns.

DNS resolves domain names to IP addresses, not routing or dynamic IP allocation. FTP (File Transfer Protocol) handles file transfers in the Application layer. TCP and UDP are the main Transport layer protocols: TCP is reliable and connection-oriented, UDP is faster and connectionless. HTTP/HTTPS enables web browsing. The TCP/IP model layers are: Application (HTTP, FTP, DNS), Transport (TCP, UDP), Internet (IP), and Physical (Ethernet). Understanding these protocols is essential for networking exams.

The Transport Layer (Layer 4) provides end-to-end communication between processes through Process-to-Process Communication, Multiplexing (multiple applications sharing connections), Reliability (TCP ensures correct delivery), and Flow Control. UDP is connectionless and fast but unreliable (used for DNS, streaming). TCP is reliable with guaranteed delivery. Application Layer protocols include HTTP (web communication on port 80/443 using GET/POST methods), FTP (file transfer on ports 20/21), Telnet (remote login on port 23), and SMTP (email on port 25/587).

Practical socket programming demonstrates real-world network applications. TCP echo servers receive data and send it back unchanged using socket creation, binding, listening, and continuous data handling loops. File transfer applications read file contents, send data using send() method, and receive data using receive() with specified buffer sizes, writing received data to files. UDP programming differs as it uses connectionless communication with SOCK_DGRAM sockets. UDP clients use sendto() to transmit messages with destination addresses, while servers use recvfrom() to receive data with sender information. Both client and server must use matching port numbers and address families for successful communication.

This comprehensive section covers the foundational concepts of Python socket programming for network security. The instructor establishes why network access is the most valuable asset for hackers, explaining that custom-built tools are essential when penetration testers cannot install external utilities. The Python socket module is presented as the core library for building TCP and UDP clients, servers, and packet sniffers. The section progresses from basic TCP client implementation—creating sockets with AF_INET and SOCK_STREAM, establishing connections, sending encoded byte data, and receiving responses—to advanced professional development practices. Key topics include using argparse for command-line configurability, implementing try-except blocks for graceful error handling, applying context managers for automatic resource cleanup, setting timeouts to prevent hangs, and providing clean user-friendly error messages. The RTFM principle is emphasized as the essential skill distinguishing competent developers from script kiddies.

Socket programming enables network communication between applications using TCP (reliable, connection-oriented protocol with guaranteed delivery) and UDP (faster, connectionless protocol without delivery guarantees). In C#, servers create listening sockets using StreamSocket for TCP or DatagramSocket for UDP, bind to specific IP addresses and ports, and accept incoming client connections. Clients connect to the server's endpoint and exchange data through byte buffers, with data typically encoded using UTF-8 for proper character handling.

Socket programming enables communication between programs on different network nodes using seven core system functions: socket() creates communication endpoints, bind() attaches server IP and port, listen() waits for incoming connections, accept() accepts client connections, connect() initiates client-server communication, send() and receive() exchange data (TCP), and sendto()/recvfrom() transfer datagrams (UDP), with close() terminating connections.

This video explores how transport-layer protocols have evolved over 40+ years, highlighting that while TCP and UDP have remained dominant due to their simplicity and sufficiency for diverse applications, new protocols like QUIC (Quick UDP Internet Connections) are emerging to address limitations. QUIC, which runs over UDP and sits beneath HTTP/3, demonstrates how modern transport-layer functionality can be implemented at the application layer, offering faster connection establishment (one RTT versus two RTTs for TCP+TLS), multiplexed streams that eliminate head-of-line blocking, and integrated reliability, congestion control, and security—all while leveraging familiar TCP-style algorithms for data transfer.

QUIC is a modern transport protocol that operates over UDP, combining connection establishment, encryption (TLS 1.3), flow control, and loss recovery into a single protocol layer, enabling it to establish secure connections in just one network round trip compared to TCP's three-way handshake plus TLS negotiation; it also supports zero-RTT for returning clients, making it significantly faster for web applications while leveraging UDP's widespread kernel support for rapid deployment.

QUIC is a new transport protocol that replaces TCP by deeply integrating with TLS and using UDP, enabling faster connection setup through combined handshakes, eliminating head-of-line blocking via stream multiplexing at the transport layer, and supporting connection migration across networks. HTTP/3 is the application layer protocol built on QUIC, featuring encrypted headers (QPACK) and stream prioritization. These protocols are already deployed by major companies like Google, Facebook, and Amazon, with approximately 25% of internet traffic using them. The shift requires network administrators to adapt firewalls and troubleshooting tools, as QUIC's encryption makes traditional inspection difficult.

The transport layer contains protocols governing how data travels between systems. TCP (Transmission Control Protocol) provides reliable communication through a three-way handshake, offering retransmission, flow control, and congestion management. It ensures data arrives intact and in order, making it ideal for web browsing, email, and databases, though at the cost of increased latency. UDP (User Datagram Protocol) prioritizes speed over reliability, sending packets without acknowledgments—perfect for real-time applications like video conferencing and gaming where occasional packet loss is acceptable. QUIC (Quick UDP Internet Connections) represents modern evolution, combining UDP speed with TCP reliability through stream-based transmission that prevents head-of-line blocking. QUIC integrates with HTTP/3 and built-in TLS encryption, addressing TCP's limitations while maintaining performance benefits.

TCP (Transmission Control Protocol) operates at the transport layer and provides reliable, ordered data delivery. It establishes a connection through a 'handshake' process before data transfer begins, ensuring data arrives in the correct order and without errors. However, this reliability comes at the cost of overhead - TCP requires constant confirmation of received data, making it heavier and slower. UDP (User Datagram Protocol) provides fast, connectionless data transmission without guarantees of delivery or order, making it suitable for applications where speed is more important than reliability, such as video streaming. QUIC is a modern transport protocol developed by Google in 2013 that runs on top of UDP, combining TCP's reliability with UDP's speed for faster connection establishment and improved performance.