Transport layer: which application gets the data
IP gets a packet to the right device. The transport layer, TCP or UDP, gets it to the right application on that device, using port numbers. A web server listens on port 443; your browser uses a random high port (like 51234) as its source.
| TCP | UDP | |
|---|---|---|
| Connection | Set up first (three-way handshake) | None: just send |
| Reliable | Yes: numbered segments, acknowledgements, resends what was lost | No: lost is lost |
| Order | Puts segments back in order | No ordering |
| Flow control | Yes (window size) | No |
| Header | 20 bytes or more | 8 bytes |
| Good for | Web, email, file transfer, SSH | Voice, video, DNS lookups, DHCP, syslog, SNMP |
The three-way handshake
- Client → server: SYN ("let's talk; my first sequence number is X").
- Server → client: SYN-ACK ("OK; mine is Y, and I expect X+1 next").
- Client → server: ACK ("I expect Y+1"). Data can flow.
A connection ends with FIN and ACK from each side (or a RST to abort). Windowing lets the sender transmit several segments before waiting for an acknowledgement, and the receiver changes the window size to slow the sender down when it's busy.
Port numbers to know
| Port | Protocol | Transport |
|---|---|---|
| 20, 21 | FTP data, control | TCP |
| 22 | SSH, SCP, SFTP | TCP |
| 23 | Telnet | TCP |
| 25 | SMTP (email) | TCP |
| 53 | DNS | UDP (TCP for big answers and zone transfers) |
| 67, 68 | DHCP server, client | UDP |
| 69 | TFTP | UDP |
| 80, 443 | HTTP, HTTPS | TCP (HTTP/3 uses UDP 443) |
| 123 | NTP | UDP |
| 161, 162 | SNMP, SNMP traps | UDP |
| 514 | Syslog | UDP |
| 49 / 1812, 1813 | TACACS+ / RADIUS | TCP / UDP |
Remember: Ports 0-1023 are well-known (servers), 1024-49151 registered, 49152-65535 dynamic (clients pick their source port here).
Tip: Real-time traffic uses UDP because a late voice sample is useless: resending it would only add delay. The application copes with a little loss instead.