Transport Layer

The transport layer connects application endpoints across an IP network. TCP and UDP both use 16-bit port numbers, but they expose different communication models and guarantees to applications.

Ports and Sockets

A destination port helps the operating system deliver traffic to a listening socket. A connection or flow is identified by more than one port: protocol, source and destination addresses, and source and destination ports all matter. The same server port can therefore support many simultaneous clients.

CheckHow can one TCP server port handle several clients at once?

Each connection has a distinct combination of endpoint addresses and ports. The server permanently renames its port after each packet. IP removes all source addresses before delivery.

TCP Byte Streams

TCP provides an ordered, reliable byte stream while a connection remains viable. It uses sequence numbers, acknowledgements, retransmission, flow control, and congestion control. TCP does not preserve application message boundaries: one write can arrive through several reads, or several writes can be returned by one read. Applications define their own framing.

Reliability is not absolute delivery. A connection can time out, reset, or fail, and an acknowledgement does not prove that an application durably committed the data.

CheckWhat happens to application message boundaries in TCP?

TCP exposes an ordered byte stream without preserving write boundaries. Every write becomes exactly one IP packet and one read. TCP converts each message into a DNS record.

The TCP Handshake

A normal TCP connection begins with a three-way handshake:

1. The initiator sends SYN with its initial sequence information.
2. The listener replies SYN-ACK with its own sequence information and acknowledgement.
3. The initiator returns ACK.

This establishes transport state in both endpoints. It does not authenticate the application server or prove that the requested application operation will succeed.

CheckWhat is the normal TCP three-way handshake order?

SYN, SYN-ACK, ACK. ACK, ACK, SYN. SYN, FIN, RST.

UDP Datagrams

UDP preserves datagram boundaries and provides checksum-based error detection, but it does not provide TCP-style connection state, ordering, retransmission, flow control, or congestion control. An application can add any needed reliability or congestion behavior itself. UDP is not automatically faster; performance depends on protocol design, workload, path, and implementation.

CheckWhich property does UDP provide to applications?

An automatically retransmitted ordered byte stream. Preserved boundaries between submitted datagrams. Guaranteed delivery before a fixed deadline.

Inspecting Transport Endpoints

Use ss to inspect listening and connected sockets without changing them:

$ ss -lntup
$ ss -tn state established

Process details can require privileges. A listening socket proves local readiness only at the transport boundary; firewall, routing, address family, TLS, and application health still need appropriate tests.

CheckWhat does a listening TCP socket establish?

Every remote firewall permits the connection. The application has passed every health check. A local process is prepared to accept matching TCP connections.

Summary

You can now distinguish TCP stream behavior from UDP datagram behavior.

1. Identify a flow using protocol, addresses, and ports.
2. Treat TCP as a reliable ordered byte stream without message boundaries.
3. Recognize what the TCP handshake does and does not prove.
4. Treat UDP reliability and congestion behavior as application design choices.
5. Verify application health beyond local socket state.