What is the difference between TCP and UDP?¶
TCP and UDP are two ways of transporting data across an IP network. Both carry IP packets and both can use port numbers to direct traffic to the right application or service.
The main difference is how they manage the communication.
TCP: a managed connection¶
Transmission Control Protocol (TCP) normally establishes a connection before the main data is exchanged. It then:
- keeps track of what has been sent;
- checks that data arrives;
- resends missing data; and
- puts data back into the correct order.
This makes TCP useful where complete, ordered delivery matters. Web traffic, email, file transfers and many remote-access services commonly use it.
UDP: individual datagrams¶
User Datagram Protocol (UDP) sends individual datagrams without creating the same managed connection. UDP itself does not:
- confirm that a datagram arrived;
- resend missing data; or
- guarantee the order in which several datagrams arrive.
That lighter approach suits services where speed and timing matter. Voice and video calls, online games and many DNS queries commonly use UDP.
Applications can add their own reliability on top. QUIC, used by HTTP/3, runs over UDP but provides additional connection management itself.
What a log entry tells you¶
If a record says TCP or UDP, it tells you which transport protocol the system recorded. Use that value with the IP addresses, ports and timestamp when following the connection through other records.
Neither protocol automatically tells you:
- which application generated the traffic;
- what the traffic contained; or
- whether it was encrypted.
Those answers come from the surrounding fields and the systems that recorded the event.
Operational takeaway
Preserve TCP or UDP as part of the connection details. It can be essential when matching records, particularly where an IP address was shared.
