Chapter 22: Transmission Control Protocol and User Datagram Protocol
This chapter introduction situates the Transport Layer after Layers 1–3 and previews coverage of TCP and UDP.
After this chapter you will be able to
- Layer 4 application delivery. Explain how Layer 4’s role differs from Layer 3’s: Layer 3 gets data to the destination host, while Layer 4 helps it reach the correct application process. Describe how Layer 4 relies on lower layers to deliver its segments and serves Application Layer protocols.
- Application addressing with ports. Explain that a Layer 4 port is a number, not a physical connector, that addresses a message to a specific application process on a destination host. Describe how a service uses a particular TCP or UDP port, such as HTTPS using TCP port 443.
- Request and reply ports. Trace the source and destination ports in the PC1-to-SRV1 HTTPS example and explain what happens to those ports in SRV1’s reply.
- Session multiplexing with source ports. Explain how a client keeps multiple sessions with the same server separate by choosing a source port from the ephemeral range for each session.
- TCP connection lifecycle. Describe TCP’s connection-oriented sequence of establishment, data exchange, and termination, including the usual flag sequences for starting and ending a connection.
- Sequencing and acknowledgment numbers. Explain how TCP sequence and acknowledgment numbers help order data and confirm its receipt.
- Retransmission and checksum errors. Explain when TCP retransmits a segment and how a checksum error can lead to retransmission.
- Window-based flow control. Explain how TCP uses the Window Size field to keep a sender from overwhelming a receiver.
- UDP delivery characteristics. Explain how UDP uses port numbers for Layer 4 addressing and session multiplexing while providing no connection establishment, reliable delivery, sequencing, or flow control.
- Datagrams versus data streams. Distinguish UDP’s independent datagrams from TCP’s continuous data stream and explain how their transmitted chunks relate to the structure of the data.
- TCP overhead tradeoffs. Explain the data, processing, and time overhead TCP incurs compared with UDP, and relate that overhead to TCP’s additional features.
- Reliable delivery with TCP. Justify why file transfers, web browsing, and email typically use TCP despite its overhead.
- Timely exchanges with UDP. Explain why real-time applications and simple DNS queries often favor UDP over TCP.
What it builds on
- The layers of the TCP/IP model (chapter 4) · The roles of the layers in the TCP/IP model.
- Data encapsulation and de-encapsulation (chapter 4) · The distinction between data encapsulated at different networking layers.
Section by section
Introduction
This chapter introduction situates the Transport Layer after Layers 1–3 and previews coverage of TCP and UDP.
22.1 The role of Layer 4
This section explains why delivering data to the right host is not enough: Layer 4 helps deliver it to the right application process while relying on lower layers.
- Layer 4 application delivery: Explain how Layer 4’s role differs from Layer 3’s: Layer 3 gets data to the destination host, while Layer 4 helps it reach the correct application process. Describe how Layer 4 relies on lower layers to deliver its segments and serves Application Layer protocols.
Why it matters: It explains why reaching the right IP destination alone does not complete communication with an application.
Key terms: Layer 4, Layer 3, application process, Layer 4 segments, Application Layer
22.1.1 Port numbers
This section explains how TCP and UDP port numbers direct messages to application services, how ports work in a request and reply, and how port numbers are grouped into ranges.
- Application addressing with ports: Explain that a Layer 4 port is a number, not a physical connector, that addresses a message to a specific application process on a destination host. Describe how a service uses a particular TCP or UDP port, such as HTTPS using TCP port 443.
Why it matters: Ports let a host deliver incoming traffic to the intended service. - Request and reply ports: Trace the source and destination ports in the PC1-to-SRV1 HTTPS example and explain what happens to those ports in SRV1’s reply.
Why it matters: Following both port numbers makes it possible to identify the service and the client side of an exchange. - Port number ranges: Distinguish the well-known, registered, and ephemeral port ranges by their numbers and stated purposes.
Why it matters: The ranges explain why a service may use an assigned port while a client uses a temporary source port.
Key terms: Layer 4 port, destination port, listen on, TCP, UDP, source port, ephemeral port, TCP segment, IANA, well-known ports
22.1.2 Session multiplexing
This section explains how source ports keep simultaneous client-server sessions separate and how a pair of sockets identifies a session.
- Session multiplexing with source ports: Explain how a client keeps multiple sessions with the same server separate by choosing a source port from the ephemeral range for each session.
Why it matters: Source ports explain why activity in one browser session does not appear in another. - Sockets and session five-tuples: Describe what makes up a socket and how two sockets identify a session as a five-tuple.
Why it matters: The five-tuple gives a precise way to describe which two endpoints and protocol belong to a session.
Key terms: session, session multiplexing, source port, ephemeral port range, socket, five-tuple, client socket, server socket, Layer 4 protocol
22.2 TCP and UDP
Introduces TCP and UDP as the two main Layer 4 protocols and explains why comparing them matters for the CCNA exam.
22.2.1 Transmission Control Protocol
This section explains how TCP establishes and ends connections, orders and acknowledges data, retransmits missing or corrupted segments, and controls how much data a sender sends.
- TCP connection lifecycle: Describe TCP’s connection-oriented sequence of establishment, data exchange, and termination, including the usual flag sequences for starting and ending a connection.
Why it matters: The handshakes distinguish TCP’s connection setup and teardown from the data exchange between them. - Sequencing and acknowledgment numbers: Explain how TCP sequence and acknowledgment numbers help order data and confirm its receipt.
Why it matters: These numbers let TCP track both the order of data and what the other host has received. - Retransmission and checksum errors: Explain when TCP retransmits a segment and how a checksum error can lead to retransmission.
Why it matters: Retransmission is how TCP responds when sent data is not successfully acknowledged. - Window-based flow control: Explain how TCP uses the Window Size field to keep a sender from overwhelming a receiver.
Why it matters: Flow control helps TCP match sending to what the receiver can handle instead of causing avoidable drops and retransmissions.
Key terms: connection-oriented, three-way handshake, SYN, ACK, FIN, four-way handshake, Sequence Number, Acknowledgment Number, data sequencing, retransmission
22.2.2 User Datagram Protocol
This section explains UDP’s limited delivery mechanisms and contrasts its independent datagrams with TCP’s data stream.
- UDP delivery characteristics: Explain how UDP uses port numbers for Layer 4 addressing and session multiplexing while providing no connection establishment, reliable delivery, sequencing, or flow control.
Why it matters: These characteristics distinguish what UDP does—and does not do—for an application’s traffic. - UDP header and checksum: Describe the size of UDP’s header and explain what its checksum can and cannot do when a message has an error.
Why it matters: Detecting an error is different from recovering the affected message. - Datagrams versus data streams: Distinguish UDP’s independent datagrams from TCP’s continuous data stream and explain how their transmitted chunks relate to the structure of the data.
Why it matters: The distinction explains why a UDP datagram is an independent unit while a TCP segment may end partway through the data being sent.
Key terms: UDP, port numbers, session multiplexing, flow control, data sequencing, UDP header, checksum, error detection, retransmission, datagram
22.2.3 Comparing TCP and UDP
This section compares TCP’s overhead with UDP’s lighter operation and explains why different applications choose one or the other.
- TCP overhead tradeoffs: Explain the data, processing, and time overhead TCP incurs compared with UDP, and relate that overhead to TCP’s additional features.
Why it matters: The overhead explains why TCP’s useful features are not the best fit for every exchange. - Reliable delivery with TCP: Justify why file transfers, web browsing, and email typically use TCP despite its overhead.
Why it matters: It connects TCP’s reliability to applications where missing or disordered content is unacceptable. - Timely exchanges with UDP: Explain why real-time applications and simple DNS queries often favor UDP over TCP.
Why it matters: It shows that the best transport choice depends on whether speed or recovery of missing data matters more. - Reliability above UDP: Describe how an application can use UDP even when it needs reliable delivery, using TFTP as the example.
Why it matters: It prevents the mistaken conclusion that every reliable file transfer must run over TCP.
Key terms: data overhead, processing overhead, time overhead, three-way handshake, TCP, data integrity, file transfers, HTTP, HTTPS, SMTP
22.3 Summary
Where this is used later
- Matching TCP/UDP port numbers (chapter 24) · Matching TCP and UDP port numbers in extended ACLs relies on what those numbers identify.
Concepts explained in this chapter
- three-way handshakeA three-way handshake is a three-message exchange used by TCP hosts to establish a connection before transmitting application data.
- TCPTransmission Control Protocol is a transport-layer protocol that provides reliable, connection-oriented delivery with mechanisms for detecting and recovering from lost data.
- ACK flagThe ACK flag is a TCP control bit indicating that the acknowledgment-number field is valid for acknowledging received data or control messages.
- FIN flagThe FIN flag is a TCP control bit used to signal that a host has finished sending data and is closing its direction of a connection.
- SYN flagThe SYN flag is a TCP control flag used to initiate connection establishment and synchronize sequence numbers.
- acknowledgment numberAn acknowledgment number is a TCP value identifying the next sequence number or byte the receiver expects.
- four-way handshakeA four-way handshake is the typical four-message TCP procedure for terminating a connection using FIN and ACK control flags.
- retransmission timeoutA retransmission timeout is the period a TCP sender waits for an acknowledgment before retransmitting an unacknowledged segment.
- window size fieldThe window size field is a TCP-header field that advertises how much data the receiver can accept before requiring an acknowledgment.
- data sequencingData sequencing is the process of assigning or using ordering information so received data can be restored to its transmission order.
- retransmissionTCP retransmission is the sending of a segment again after its acknowledgment is not received within the retransmission timeout or its integrity check fails.
- session multiplexingSession multiplexing is the process of tracking multiple communication sessions concurrently by distinguishing them with transport-layer identifiers such as port numbers.
- UDPUser Datagram Protocol is a transport-layer protocol that sends datagrams without guaranteeing delivery of every message.
- ephemeral portAn ephemeral port is a port numbered from 49152 through 65535 that is commonly used as a client source port and does not require registration.
- registered portA registered port is a port numbered from 1024 through 49151 that protocols may register with IANA to reduce conflicts.
- well-known portA well-known port is a port numbered from 0 through 1023 that is reserved for common protocols and assigned under strict control.
- connection establishmentTCP connection establishment is the process of creating a TCP connection before application data is exchanged.
- sequence number fieldThe sequence number field is a TCP-header field that identifies the position of transmitted data in a byte stream.
- tcp checksum fieldThe TCP checksum field is a TCP-header field containing a calculated value used to detect corruption in a TCP segment.
- tcp connection terminationTCP connection termination is the process of closing a TCP connection after the necessary data has been exchanged.
- tcp flags fieldThe TCP flags field is an eight-bit TCP-header field whose individual bits indicate or control protocol behaviors.
- tcp headerA TCP header is the transport-layer header containing control, addressing, sequencing, acknowledgment, checksum, and flow-control fields for a TCP segment.
- acl sequence numberAn ACL sequence number is an ordering value assigned to an access control entry within an access control list.
- QUICQUIC is a transport-layer protocol built on UDP that provides TCP-like functionality with reduced latency and built-in encryption.
- real-time systemA real-time application is an application in which timely delivery of current data is more important than perfect delivery of all data.
- port numberA port number is a transport-layer identifier ranging from 0 to 65535 that directs network data to a particular application process on a host.
- transport layerThe transport layer is the network-model layer that delivers data to a specific application process on a destination host.
- Trivial File Transfer ProtocolTrivial File Transfer Protocol is a simple file-transfer protocol that provides its own acknowledgment-based reliability while using UDP.
- physical layerThe Physical Layer is a networking model layer that defines the transmission of raw signals and bits over a physical medium.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.