Transport: TCP, UDP and ports
Lesson 2 of 6
2Transport: TCP, UDP and ports
The big pictureOne server runs a website, a database and a mail service at once. When a packet arrives, how does it know whose it is? And who makes sure a page in a hundred pieces arrives whole and in order, when the internet loses packets every second? That is the transport layer's job.
What the picture shows: The three-way handshake opens the connection and agrees on sequence numbers, then data flows with acknowledgements, then each side closes its end.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
TCP is like registered mail: it checks every page arrived and in order, and resends what was lost. A little slower but guaranteed, so it carries websites, files and mail. UDP is like radio: it sends and does not wait; a lost word is never resent, which suits calls and games where delay is worse than a small gap. A port is the flat number in a building: the building is the machine, the flat the program.
TCP (RFC 9293) is connection-oriented: a SYN, SYN-ACK, ACK handshake, sequence numbers and acknowledgements, retransmission, flow control by window, and congestion control. Its header is 20 to 60 bytes. UDP is connectionless with an 8-byte header and leaves reliability to the application; QUIC, which carries HTTP/3, is built on it. Ports 0 to 1023 are well known, 1024 to 49151 registered, 49152 to 65535 ephemeral for clients. A connection is identified by a 5-tuple: both IPs, both ports and the protocol.
Before You Start
🏷️Addresses
You know the IP identifies the machine.
🧅Layers
Transport is layer 4, above IP.
The Core Idea
1The port: which program inside the machine?
Every program listens on a port number. The web server on 443, SSH on 22, PostgreSQL on 5432. An address with a port is a socket, written 203.0.113.10:443. Your browser also opens a random temporary port for each connection, so it knows which answer belongs to which tab.
| Port | Protocol | Transport | What it does |
|---|---|---|---|
22 | SSH · SFTP | TCP | Secure login and encrypted file transfer |
25 | SMTP | TCP | Sending mail between servers |
53 | DNS | UDP/TCP | Turning names into addresses |
67/68 | DHCP | UDP | Handing out addresses automatically |
80 | HTTP | TCP | The unencrypted web |
123 | NTP | UDP | Time sync |
443 | HTTPS | TCP, and UDP for HTTP/3 | The encrypted web |
3389 | RDP | TCP | Remote desktop |
2TCP: the handshake and acknowledgements
Before any data, the two sides exchange three messages to agree on starting numbers. After that every piece has a sequence number, and the receiver answers with an ACK saying "I have it up to here". If the ACK does not come in time, the sender resends. That is why a page arrives whole even when packets are lost on the way.
A small simulation of the TCP idea: each piece is resent until its ACK comes back.
import random
random.seed(7) # same "lost packets" every run
pieces = ["<html>", "<head>", "<body>", "Hello", "</html>"]
received = {}
sends = 0
for seq, piece in enumerate(pieces):
while seq not in received:
sends += 1
if random.random() < 0.3: # the internet loses this one
print(f"seq {seq} lost -> no ACK -> resend")
continue
received[seq] = piece
print(f"seq {seq} ok -> ACK {seq + 1}")
print("page:", "".join(received[i] for i in sorted(received)))
print(f"{len(pieces)} pieces, {sends} sends")3UDP: fast, no promises
In a video call, a voice packet lost half a second ago is worthless now; resending it delays everything after it. That is why calls, games and DNS use UDP: a message goes and does not wait. QUIC, the base of HTTP/3, builds smart reliability on top of UDP instead of TCP so that one lost packet does not hold everything else up.
Worked example
The task: you run ss -tn on a server and see ESTAB 10.0.0.5:443 198.51.100.20:51514. What does it mean? The answer: an established TCP connection between the server on port 443 (HTTPS) and a client at 198.51.100.20 that opened a temporary port 51514. The five values: the two addresses, the two ports and TCP. If the client opened another tab, you would see a second line with a different temporary port.
Myth vs Reality
| Myth | Reality |
|---|---|
| UDP is unreliable, so nothing important uses it. | DNS, your calls and HTTP/3 all run on UDP; reliability is built into the app when needed. |
| A port is a physical place on the machine. | It is just a number in the header; it has nothing to do with cable sockets. |
| Every connection needs a different port on the server. | Thousands of connections share 443; they are told apart by the client's address and port. |
Where you meet it at work
🔥Firewall
Most rules are written with ports: allow 443, block 23.
🧑💻Developer
The "address already in use" error means another program listens on the port.
🎮Games and streaming
UDP with correction in the app to keep delay low.
Test your understanding
What is the order of the three-way handshake?
The client asks, the server agrees and asks back, the client confirms.
Which service usually runs on UDP 53?
DNS is a short question and answer, a good fit for UDP.
Why do video calls use UDP?
Late audio is useless; better to move on.
What tells apart two connections from your machine to the same server on 443?
All five values match except the source port.
Which port does HTTPS use by default?
80 for HTTP, 22 for SSH, 53 for DNS.
A live video call usually prefers:
A late frame is useless; speed beats retransmission.
Quick review cards
Check Your Understanding
What are TCP sequence numbers for?
Putting the pieces in order and spotting the missing ones to resend.
Why is Telnet on port 23 a risk?
It sends everything unencrypted, passwords included. Use SSH on 22.
How many round trips does the TCP handshake cost before data?
One full round trip.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Official docs1
Done with this lesson?
Sign in to save your progress.