Beginner · How networks work · topic 5 of 57 · 35 min
TCP, UDP and port numbers
Explanation
Why a transport layer?
An IP address gets a packet to the right computer. But one computer runs many programs at once: a browser, WhatsApp Web, an email client. The transport layer uses port numbers to get data to the right program. It can also make delivery reliable, which IP alone does not do.
Ports and sockets
A port is a 16-bit number, from 0 to 65535, that identifies a program or service on a host. Servers listen on fixed ports so clients know where to find them: a web server listens on 443. Clients use a temporary port, picked fresh for each connection.
| Range | Name | Used for |
|---|---|---|
| 0 to 1023 | Well-known (system) ports | Standard services: 22 SSH, 80 HTTP, 443 HTTPS |
| 1024 to 49151 | Registered (user) ports | Applications registered with IANA, for example 3389 RDP, 3306 MySQL |
| 49152 to 65535 | Dynamic, private or ephemeral ports | Temporary client-side ports |
IANA (the Internet Assigned Numbers Authority) keeps the official list. Operating systems pick ephemeral ports from their own range: Windows uses 49152 to 65535, while Linux uses 32768 to 60999 by default.
A socket is the combination of an IP address, a protocol and a port, such as 203.0.113.10 TCP port 443. A TCP connection is identified by its two sockets: client IP and port plus server IP and port. That is how one server can handle thousands of users on the same port 443 at once.
TCP: reliable and connection-oriented
TCP (Transmission Control Protocol) first sets up a connection with the three-way handshake:
- SYN: the client sends a segment with the SYN flag and its starting sequence number.
- SYN-ACK: the server replies with SYN and ACK flags, its own starting sequence number, and an acknowledgement of the client one.
- ACK: the client acknowledges the server. The connection is open and data can flow.
Every byte of data gets a sequence number. The receiver sends back an acknowledgement (ACK) number that means "I have everything up to here, send me this byte next". If an acknowledgement does not arrive in time, the sender retransmits. The receiver also uses sequence numbers to put segments back in the right order.
Windowing is TCP flow control. The receiver advertises a window size, how many bytes it can accept before the sender must wait for an ACK. A large window lets data flow without pausing; if the receiver is busy, it shrinks the window and the sender slows down.
A connection normally closes with four segments: FIN from one side, ACK, FIN from the other side, ACK. A RST (reset) segment closes a connection at once, for example when a port has no program listening.
UDP: simple and fast
UDP (User Datagram Protocol) has no handshake, no sequence numbers, no acknowledgements and no retransmission. Its header is only 8 bytes, compared with at least 20 for TCP. If a datagram is lost, it is gone, unless the application handles it. That is fine, and even better, for live voice and video (a late packet is useless anyway), DNS lookups (one small question, one small answer; just ask again) and DHCP.
| TCP | UDP | |
|---|---|---|
| Connection | Yes, three-way handshake | No, just send |
| Reliable delivery | Yes, ACKs and retransmission | No |
| Ordering | Yes, sequence numbers | No |
| Flow control | Yes, windowing | No |
| Header size | 20 bytes or more | 8 bytes |
| Typical uses | Web, email, SSH, file transfer | Voice, video, DNS queries, DHCP, TFTP, SNMP, syslog |
Ports to learn by heart
| Port | Protocol | Service |
|---|---|---|
| 20, 21 | TCP | FTP data (20) and control (21) |
| 22 | TCP | SSH, secure remote login |
| 23 | TCP | Telnet, insecure remote login |
| 25 | TCP | SMTP, sending email between servers |
| 53 | UDP and TCP | DNS (UDP for most queries, TCP for large answers and zone transfers) |
| 67, 68 | UDP | DHCP server (67) and client (68) |
| 69 | UDP | TFTP, simple file transfer (used for router images and IP phone configs) |
| 80 | TCP | HTTP |
| 110 | TCP | POP3, downloading email |
| 123 | UDP | NTP, time sync |
| 143 | TCP | IMAP, reading email on the server |
| 161, 162 | UDP | SNMP polling (161) and traps (162) |
| 443 | TCP (and UDP for HTTP/3) | HTTPS |
| 514 | UDP | Syslog |
| 3389 | TCP | RDP, Windows Remote Desktop |
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
TCP, UDP and port numbers · 1/7
IP gets data to the right computer. The transport layer gets it to the right program, using port numbers.
Prefer a video by a teacher? Find free videos on “TCP vs UDP three way handshake port numbers explained CCNA” on YouTube ↗
In real life: A UPI payment and a video call on one phone
When you pay with a UPI app, the app opens a TCP connection to the bank server on port 443 (HTTPS). Every byte of that payment request must arrive, so TCP is the right choice. At the same time, a WhatsApp video call uses UDP-based media streams: if a few packets are lost, the picture blurs for a moment, which is better than freezing while TCP waits to resend old frames. Both run together because each uses its own source port.
Proto Local Address Foreign Address State
TCP 192.168.1.7:51514 203.0.113.25:443 ESTABLISHED
TCP 192.168.1.7:51522 198.51.100.40:443 ESTABLISHED
UDP 192.168.1.7:61000 *:*Practice (0/3 done)
Write port_range(port) that returns "well-known" for 0 to 1023, "registered" for 1024 to 49151, "dynamic" for 49152 to 65535, and "invalid" for anything else.
Write service(port) that returns the service name for these well-known ports: 22 "SSH", 23 "Telnet", 25 "SMTP", 53 "DNS", 67 "DHCP", 68 "DHCP", 69 "TFTP", 80 "HTTP", 110 "POP3", 123 "NTP", 143 "IMAP", 443 "HTTPS", 3389 "RDP". Any other port returns "unknown".
A client sends SYN and the server answers SYN-ACK. What does the client send next?
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- TCP/IP and the network layersCyber Security: from zero to SOC analyst · Networking for security
- DNS: names to addressesIP services: DHCP, DNS, NAT and more
- Ports and protocolsCyber Security: from zero to SOC analyst · Networking for security
- Clients, servers, IP addresses and URLsBackend Development · How the web and backends work
- DNS: the internet's phone bookCyber Security: from zero to SOC analyst · Networking for security
- Linux networking for DevOpsDevOps: Git, Docker, Kubernetes and CI/CD · Linux for DevOps
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Which protocol is best for a live cricket audio stream where late packets are useless?
Answer: UDP
UDP does not wait to resend lost packets, which suits live audio and video.
Which port does SSH use?
Answer: 22
SSH uses TCP port 22. Telnet uses 23.
What does a TCP receiver use the window size for?
Answer: To tell the sender how much data it can send before waiting for an ACK
Windowing is TCP flow control.
Which statement about DNS is correct?
Answer: It uses UDP port 53 and also TCP port 53
Most DNS queries use UDP 53; large replies and zone transfers use TCP 53.
What identifies one TCP connection uniquely?
Answer: The client and server IP addresses and ports
A connection is the pair of sockets: client IP and port plus server IP and port.
What is the correct order of the TCP handshake?Related
Which OSI layers are combined into the TCP/IP application layer?Related
Answer: Layers 5, 6 and 7
Session, presentation and application become one application layer.
Which transport does DNS normally use for ordinary queries?Related
Answer: UDP 53
Normal queries use UDP 53; TCP 53 is used for zone transfers and large answers.
Which port range does your computer usually pick its source port from?Related
Answer: 49152–65535
Clients use dynamic (ephemeral) ports, 49152–65535 in the IANA range.
From Ports and protocols
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “How networks work”. The module exam comes next.
- Module 1 exam: How networks work · 13 questions · 20 min, without help. 5 topics of this module still to finish first.
- Then the next module, Ethernet, MAC addresses and the Cisco CLI. 57 topics left in the course before the final exam.