NETWORK
TCP vs UDPReliable streams versus lightweight datagrams
TCP delivers a reliable, ordered byte stream over a connection established with a three-way handshake, retransmitting anything lost. UDP sends independent datagrams with no connection, no retransmission and no ordering, which makes it faster and lighter. Web pages, email and file transfers use TCP; DNS, video calls, games and DHCP use UDP.
Side by side
| Property | TCP | UDP |
|---|---|---|
| Connection | Established with a handshake, closed with FIN/RST | None; each datagram stands alone |
| Reliability | Lost segments are retransmitted | Lost datagrams are gone |
| Ordering | Bytes arrive in order | Datagrams may arrive out of order or duplicated |
| Flow control | Receiver window limits the sender | None |
| Congestion control | Sender slows down when loss is detected | None; application must behave |
| Header | 20 bytes minimum | 8 bytes |
| Message boundaries | None (byte stream) | Preserved (one send = one datagram) |
| Typical uses | HTTP/1.1, HTTP/2, SSH, SMTP, IMAP, RDP, databases, file transfer | DNS, DHCP, NTP, SNMP, VoIP/RTP, video streaming, games, QUIC, VPNs |
How TCP builds reliability
- Handshake. SYN → SYN-ACK → ACK establishes sequence numbers in both directions. Half-open connections (SYN received, no ACK) are what SYN-flood attacks exploit.
- Sequence numbers and acknowledgements. Every byte is numbered; the receiver acknowledges what it has. Unacknowledged data is retransmitted after a timeout or on duplicate ACKs.
- Windows. The receiver advertises how much it can accept; the sender's congestion window grows and shrinks with network conditions (slow start, congestion avoidance).
- Teardown. FIN from each side, or RST to abort. Connections in
TIME_WAITin netstat output are recently closed and waiting for stray packets to expire.
The cost is latency: one round trip before any data, and a lost packet stalls everything behind it (head-of-line blocking).
Why UDP exists
Some applications would rather have a late packet dropped than delayed. A VoIP call cannot use audio that arrives 500 ms late; a game cannot use a position update from two frames ago; a DNS query is so small that a handshake would triple its cost. UDP gives those applications a bare socket and lets them add whatever reliability they need (RTP adds sequence numbers and timestamps; DNS retries on timeout).
UDP's simplicity has a downside: because there is no handshake, the source address is unverified, which is why UDP services such as DNS, NTP, SNMP and SSDP are abused for reflected amplification attacks.
QUIC: the best of both
QUIC runs over UDP but implements its own reliable streams, encryption (TLS 1.3 built in) and connection migration. Losing a packet on one stream does not block others, and a connection can survive a change of IP address. HTTP/3 uses it on UDP 443.
What this means for firewalls and troubleshooting
- A TCP port can be tested with a simple connect (
Test-NetConnection -Port); a UDP port cannot, because there is no reply to a bare probe. Use the application's own client. - Stateful firewalls track TCP connections precisely. For UDP they approximate a "connection" by timing out flows, which is why long-idle UDP sessions (VPNs, VoIP) need keepalives.
netstat -p tcpandnetstat -p udplist the two families separately; UDP entries show no state column because there is no state.
Frequently asked questions
Is UDP faster than TCP?
UDP has less overhead and no handshake or retransmission delay, so for applications that can tolerate loss it delivers lower latency. For bulk transfer on a clean network, TCP achieves similar throughput. "Faster" depends on what the application needs.
Can a port be both TCP and UDP?
Yes. TCP port 53 and UDP port 53 are separate; a program can listen on one, the other or both. IANA registers most services for both transports even when only one is used.
What is the three-way handshake?
The client sends SYN, the server replies SYN-ACK, the client sends ACK. Both sides now agree on starting sequence numbers and the connection is established. Test-NetConnection -Port succeeds when this completes.
Does HTTPS use TCP or UDP?
HTTP/1.1 and HTTP/2 use TCP 443. HTTP/3 uses QUIC over UDP 443, which gives reliable, encrypted streams without TCP's head-of-line blocking.