Watch first

Plain-English explanation

TCP is the careful courier: three-way handshake, sequence numbers, acknowledgments, retransmissions, and flow control. It guarantees ordered delivery — at the cost of overhead and delay.

UDP is the postcard: connectionless, minimal header, no guarantee of delivery or order. Fast and simple — perfect when late data is useless (live voice/video) or when the app handles reliability itself.

Both use 16-bit port numbers (0–65535) so multiple applications can share one IP address. A socket is roughly IP + port + protocol.

Deep dive

| Feature | TCP | UDP | |---------|-----|-----| | Connection | Connection-oriented | Connectionless | | Reliability | Yes — ACKs, retransmit | No | | Ordering | Yes | No | | Overhead | Higher (20+ byte header) | Lower (8 byte header) | | Speed | Lower latency tolerance | Lower overhead, faster | | Use cases | Web, SSH, email, file transfer | DNS, DHCP, SNMP, VoIP, QUIC-based apps |

Well-known ports (memorize a handful): 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 161 SNMP.

Step-by-step — TCP handshake and teardown

Three-way handshake (open):

1. Client → Server: SYN, seq=100
2. Server → Client: SYN-ACK, seq=300, ack=101
3. Client → Server: ACK, ack=301

Graceful close (simplified): FIN → ACK → FIN → ACK. Exam questions may ask which flags appear — know SYN, ACK, FIN, RST.

UDP send: No handshake. Host wraps payload in UDP header with src/dst ports and passes to IP immediately.

Commands to know

Client → Server: SYN
Server → Client: SYN-ACK
Client → Server: ACK

Windows
netstat -an | findstr TCP
Linux
ss -tuln

show ip sockets
show control-plane host open-ports

Troubleshooting

| Symptom | Consider | |---------|----------| | Web slow but ping fine | TCP retransmits — congestion, MTU, asymmetric routing | | VoIP choppy | UDP loss/jitter — QoS, buffer, Wi-Fi | | DNS intermittent | UDP 53 blocked; large responses fall back to TCP 53 | | Connection refused | No listener on destination port (RST) | | SYN without SYN-ACK | Firewall, ACL, or service down |

Capture tools (Wireshark) show retransmits and RST flags — invaluable beyond CCNA, but know the theory first.

Exam relevance

Practice checklist

• List five TCP and five UDP applications from memory
• Draw the three-way handshake with sequence/ack numbers
• Explain why VoIP prefers UDP over TCP
• Identify src vs dst port in a sample netstat line
• Explain what happens when a host sends UDP to a closed port (ICMP port unreachable)