After the IP-layer comes the transport layer which is divided into TCP and UDP. This is just a general overview of the Protocols. Maybe we will have a look at the different header fields later on.
TCP:
The Transmission Control Protocol(TCP) is layer 4 protocol(OSI-Model) which like the IP-Packet has a header and the data it delivers. The header contains information like the source and destination port with which to communicate.
The TCP-Header:
https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure
UDP:
The User Datagram Protocol(UDP) is also a layer 4 protocol whch contains a header and the data to be delivered. As in TCP the header contains source and destination port amongst other information. The UDP-header is much smaller than the TCP header.
The UDP-Header:
https://en.wikipedia.org/wiki/User_Datagram_Protocol#Packet_structure
Differences between UDP and TCP:
The main difference between UDP and TCP is that TCP has a reliable and ordered way of transmitting data while UDP is used for transmissions where reliability isn‘t the most important criteria. „Lesser reliability“, you may ask? Sounds kinda bad doesn't it?
What is meant by that is that TCP has a lot more stuff going on when transmitting than UDP. Hence you have different use cases for the two protocols.
TCP sends packets in a ordered way so that the other host can reassemble the packets or „ask“ for a retransmission if a packet gets lost. Therefore there a is back and forth communication going on between the client and the server. This also means that TCP is slower than UDP. TCP is used for upper layer protocols like FTP, TLS, SSH and HTTP.
In the below picture we can see the first of three so called „Handshakes“. The Handshake is the way we establish a TCP-connection. It starts with a SYN request which is highlighted below under flag but more on that later.
Also highlighted is the source port which is followed by the destination port which is 80 in this case. Port 80 is the standard port on your Apache Webserver.
UDP is faster because it throws all the error checking stuff and the back and forth communication out of the window. If a packet gets lost it is simply lost. While TCP sends Packets as a „numbered“ stream, a UDP-Packet is always whole. Therefore it is also used in DNS-requests which only consist of a single request and then a single response. It‘s also used in Voice-over-IP and livestreams.
As you can see below the UDP-Protocol has far fewer fields than TCP because it doesn't have a handshake and doesn't need to maintain a state.
The destination port here is 53 which is used for DNS-Queries In this case it asks „Where is google.com?“ to put it simply.
So that's it for today guys!!
See y'all on the data highways!