TCP vs UDP

Two transport philosophies

At the transport layer, two protocols dominate: TCP and UDP. They solve the same problem (move bytes from A to B) with opposite philosophies. Knowing when each is in play makes network behavior far less mysterious.

TCP — reliable, ordered, with bookkeeping

TCP is like a phone call. You establish a connection (the famous three-way handshake: SYN → SYN-ACK → ACK), then have a structured conversation. Every byte is numbered, acknowledged, and retransmitted if lost. If packets arrive out of order, TCP reassembles them. When you hang up, there's a graceful 4-way shutdown (FIN/ACK).

That bookkeeping costs latency, but you get guarantees: every byte arrives, in order, exactly once. SSH, HTTP/1, HTTP/2, Git, email — all TCP.

UDP — fire and forget

UDP is like shouting across a room. No handshake, no acknowledgments, no retransmissions, no ordering guarantees. Just throw a packet and move on. Why would you want this? Speed and simplicity. No round trips means lower latency. No retransmission means your video stream never freezes waiting for a missing frame.

Side by side

Feature	TCP	UDP
Connection	Three-way handshake first	None — connectionless
Reliability	Guaranteed delivery + retransmission	None — packets may vanish
Ordering	In-order reassembly	May arrive in any order
Latency	Higher (handshake + ack overhead)	Lower (just send)
Header size	20–60 bytes	8 bytes
Real-world use	SSH, HTTP, email, file transfer, DB	DNS, video/voice, gaming, WireGuard, QUIC

HTTP/3 is the interesting twist: it runs on UDP (via the QUIC protocol) but rebuilds reliability at a higher layer with multiple independent streams. Lose a packet on stream A and stream B keeps moving — something TCP fundamentally can't do because it's one byte stream.

Code

Watch the handshake yourself·bash

# Capture an SSH handshake to localhost (requires sudo)
sudo tcpdump -i lo0 -n 'port 22 and tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'

# In another terminal:
ssh localhost echo hi

# You'll see SYN, SYN-ACK, ACK in tcpdump output
# That's the TCP three-way handshake live

Exercise

Look at the tcpdump output you'll see in the code block. For an SSH connection to localhost, identify: which side sends SYN first, which side replies with SYN-ACK, and which side closes with ACK. Then make a small UDP request: dig @8.8.8.8 google.com — that's UDP, no handshake. Notice it's instant compared to even a localhost TCP setup.