The transport layer: TCP and UDP

The central layer of the internet protocol stack is the transport layer, which in the TCP/IP model can be TCP (Transport Control Protocol) or UDP (User Datagram Protocol). The TCP protocol, briefly introduced in the previous article, is actually a quite complex protocol, whose goal is to make sure that data will be received by the recipient, in the right order, and without any transmission error. UDP is a more simple protocol, which just acts as a container to transport any data in small packets, with a light mechanism to detect transmission errors, but with no guarantee that packets will be received by the recipient.
Usually, TCP is used when data integrity is more important than speed, for instance to transport e-mails, files, or Web pages, and UDP is used when speed is the priority, even at the price of a possible loss of data, for instance for real time online games or to transport voice. A data packet is usually called a datagram in the UDP protocol, and a segment in the TCP protocol.

Both TCP and UDP bring the important concept of port number: a port is a 16-bit number (i.e. with a value between 0 and 65535), which corresponds to a service offered by a host on the network. To take our well-know post office analogy, if the IP address corresponds to the address of a letter (country, city, street and number), the port corresponds to the first name of the recipient. For instance, a single computer can act as both a Web (HTTP) server and mail (STMP) server at the same time. When such a computer receives an IP packet, it has to know if the packet must be sent to the Web server or to the mail server: this is done thanks the destination port number, which is a part of the TCP header of the packet; for instance, a Web server is usually associated to the port 80, and a mail server to the port 25. The association between a given service and a port number is standard, and the whole list can be found at the address http://www.iana.org/assignments/port-numbers, or in the file /etc/services on Linux or Mac OS X (C:\WINDOWS\system32\drivers\etc\services on Windows). So, each TCP or UDP packet contains a destination port, so that the destination host can know what it has to do with the packet, and also contains a source port, which will be the destination port used by the recipient when it sends back a reply packet to the sender (if a reply is needed).

You can see all the TCP and UDP ports used by your computer with the netstat command (the exact options depend on the Operating System), for instance:

# netstat -an
Active Internet connections (servers and established)
Proto  Local Address     Foreign Address       State
tcp    0.0.0.0:22        0.0.0.0:*             LISTEN
tcp    127.0.0.1:631     0.0.0.0:*             LISTEN
tcp    192.168.1.3:22    192.168.1.2:56347     ESTABLISHED
udp    0.0.0.0:5353      0.0.0.0:*  
udp    0.0.0.0:32920     0.0.0.0:*

Each address is written in the standard form <IP address>:<port number>. The lines ending with "LISTEN" correspond to services running on the computer: for instance the first line with port 22 corresponds to a running SSH (Secure Shell) server, and the third line shows that another computer with IP address 192.168.1.2 is connected to this SSH server. The two last lines mean that two UDP services are also running on the computer, on ports 5353 and 32920.

To conclude this article, here is the format of an UDP packet (also described in the RFC 768), which contains a header of 8 bytes followed by the data:

bits | 0 - 15          | 16 - 32           |
-----+-----------------+-------------------|
0    | Source port     |  Destination Port |
-----+-----------------+-------------------|
32   | Length          |  Checksum         |
-----+-----------------+-------------------|
64   | Data
-----+----------------- - - -

The format of a TCP packet is more complex and is described in the RFC 793 (details about the TCP protocol are out of the topic of this short introduction).