Layer 4 Protocols: UDP and TCP

Most network applications use one of two Layer 4 protocols:

■ User Datagram Protocol (UDP): Applications that want to minimize network overhead and do not require detecting lost or out-of-order packets use UDP. UDP also supports multicasting, which is not possible with TCP. Most DNS queries and streaming media use UDP. Applications that use UDP can still handle retransmitting lost packets or reordering out-of-order packets, however, it must be handled within the application itself and requires more effort from the application developer.

■ Transmission Control Protocol (TCP): Applications that require detecting and resending lost or corrupted packets use TCP. Using TCP requires a connection to be established before application data can be transmitted. Specifically, the client sends a SYN packet to request a connection, the server responds with an SYN/ACK packet, and the client confirms the connection with a ACK packet. Requiring these packets to be exchanged before application data can be sent causes TCP to be slower than UDP for short-lived connections. Most applications, including e-mail and Web browsing, use TCP.

A single server typically has several different services listening for incoming connections. To allow Windows to direct incoming traffic to the correct application, incoming network requests include a port number. For example, DNS requests use port 53 by default. Therefore, when Windows receives a packet with a port number of 53, it delivers it to the DNS Server service.