📘 TCP, UDP, and QUIC

The transport layer turns host-to-host packet delivery into process-to-process communication. TCP is the most asked-about protocol in networking interviews, so this page goes deep on the handshake, reliability, flow control, and congestion control, then shows how QUIC rebuilt the same ideas on top of UDP.

Table of Contents

1. Sockets and Ports
2. UDP
3. TCP at a Glance
4. The Three-Way Handshake
5. Closing a Connection and TIME_WAIT
6. The TCP State Machine
7. Reliability
8. Flow Control
9. Congestion Control
10. Latency Tweaks: Nagle, Delayed ACK, Keepalive
11. Head-of-Line Blocking
12. QUIC
13. Choosing a Transport
14. Questions

1. Sockets and Ports

A socket is the OS handle an application uses to send and receive on the network. The classic server flow:

int fd = socket(AF_INET, SOCK_STREAM, 0);   // TCP socket
bind(fd, addr, len);                        // attach to 0.0.0.0:8080
listen(fd, backlog);                        // become a passive listener
int conn = accept(fd, ...);                 // one new socket per client connection
read(conn, buf, n); write(conn, buf, n);
close(conn);

The client calls socket then connect, and the kernel picks an ephemeral source port.

The kernel keeps two queues per listening socket: the SYN queue (half-open connections mid-handshake) and the accept queue (completed connections waiting for accept). If the application is slow to accept, the accept queue fills and new connections are dropped or reset. backlog and net.core.somaxconn bound it.

2. UDP

UDP adds only ports and a checksum on top of IP.

Use UDP when latency matters more than perfect delivery, or when you want to build your own reliability: DNS, VoIP and video calls, online games, streaming telemetry, DHCP, NTP, and QUIC itself.

A lost voice packet should be skipped, not retransmitted 200 ms later.

3. TCP at a Glance

TCP provides a reliable, ordered, full-duplex byte stream with flow control and congestion control.

 0                   1                   2                   3
|  Source port (16)             |  Destination port (16)        |
|  Sequence number (32)                                          |
|  Acknowledgment number (32)                                    |
| Offset | Rsvd | Flags (CWR ECE URG ACK PSH RST SYN FIN) | Window (16) |
|  Checksum (16)                |  Urgent pointer (16)           |
|  Options: MSS, window scale, SACK permitted, timestamps        |

TCP is a stream, not a sequence of messages. Two send calls of 100 bytes may arrive as one recv of 200 bytes, or as 50 and 150. Applications must frame messages themselves: length prefixes, delimiters, or a protocol like HTTP.

4. The Three-Way Handshake

Why three messages and not two? Each side must pick an initial sequence number (ISN) and learn that the other side received it. The client's SYN and the server's ACK of it cover one direction; the server's SYN and the client's ACK cover the other. The middle message combines both. Two messages would also let a delayed duplicate SYN from an old connection open a phantom connection.

ISNs are randomized to prevent attackers from guessing sequence numbers and injecting data.

Options negotiated in the SYNs: MSS, window scale (lets the 16-bit window grow to 1 GB), SACK permitted, and timestamps.

SYN flood: an attacker sends SYNs from spoofed addresses and never completes the handshake, filling the SYN queue. Defense: SYN cookies, where the server encodes the connection state in its ISN and stores nothing until the final ACK proves the client is real.

TCP Fast Open lets a returning client send data in the SYN using a cookie from an earlier connection, saving one RTT, but middleboxes limit its deployment.

Cost to remember: a new HTTPS connection over TCP needs 1 RTT for TCP + 1 RTT for TLS 1.3 before the first request byte, which is why connection reuse matters so much.

5. Closing a Connection and TIME_WAIT

TCP is full duplex, so each direction closes independently with a FIN.

The side that closes first enters TIME_WAIT for twice the maximum segment lifetime (60 seconds on Linux). It exists for two reasons:

1. If the final ACK is lost, the peer retransmits its FIN and the closer must still be around to ACK it.
2. Delayed packets from the old connection must expire before the same 4-tuple is reused.

Practical consequences:

RST aborts without the FIN dance: sent for a connection that does not exist, a closed port, or when an application closes a socket with unread data. "Connection reset by peer" means you received an RST.

6. The TCP State Machine

See the states live with ss -tan on Linux or netstat -an on macOS.

7. Reliability

TCP numbers every byte, not every segment. The acknowledgment number is cumulative: "I have everything up to byte N - 1, send N next".

Sliding window protocols from textbooks:

TCP is a hybrid: cumulative ACKs like Go-Back-N, but with SACK it behaves like Selective Repeat.

8. Flow Control

Flow control protects the receiver. Each ACK carries a receive window (rwnd): how many more bytes the receiver's buffer can take. The sender never has more unacknowledged data than rwnd.

If the receiver's buffer fills, it advertises a zero window and the sender stops, periodically sending window probes. A slow consumer therefore slows the producer down automatically, which is TCP's built-in backpressure.

The 16-bit window field caps at 64 KB, so the window scale option multiplies it (up to 2^14), allowing windows of about 1 GB for high bandwidth-delay paths.

9. Congestion Control

Congestion control protects the network. The sender keeps a congestion window (cwnd) and may have at most min(cwnd, rwnd) bytes in flight.

ECN (explicit congestion notification) lets routers mark packets instead of dropping them, so senders slow down without losing data.

Why this matters in practice:

• A fresh connection starts slow, so reusing warm connections is faster than opening new ones.
• Loss on the path (Wi-Fi, mobile) makes loss-based algorithms back off even when the link is not congested, which is one reason BBR exists.
• Flow control and congestion control are different things, and interviewers love that distinction.

10. Latency Tweaks: Nagle, Delayed ACK, Keepalive

NAT gateways and load balancers drop idle connections after their own timeout (AWS NLB is 350 seconds by default), so long-lived idle connections need keepalives shorter than that.

11. Head-of-Line Blocking

Because TCP delivers bytes strictly in order, one lost segment blocks everything behind it until the retransmission arrives, even data belonging to unrelated requests.

12. QUIC

QUIC (RFC 9000, 2021) is a transport protocol built on UDP, with TLS 1.3 built in. HTTP/3 runs on it, and a large share of web traffic from browsers to big providers now uses it.

Costs: UDP is sometimes blocked or rate limited by enterprise firewalls (clients fall back to TCP), user-space processing uses more CPU than kernel TCP with its offloads, and debugging requires keys because packets are encrypted.

13. Choosing a Transport

14. Questions

Next: DNS, HTTP, and TLS.