Transport Layer, UDP, TCP and Sockets

IP delivers datagrams to a host. The transport layer delivers data to the right process on that host, and (in TCP) makes the delivery reliable.

Ports and multiplexing

A process is identified by a 16-bit port number. Servers listen on well-known ports (0–1023); clients get a temporary (ephemeral) port from the operating system.

A TCP connection is identified by the 4-tuple (source IP, source port, destination IP, destination port), so one web server on port 80 can serve thousands of clients at once. A UDP socket is identified by just (destination IP, destination port).

UDP

UDP (User Datagram Protocol) adds almost nothing to IP: ports and a checksum.

The header is only 8 bytes. UDP is connectionless and unreliable: no handshake, no acknowledgements, no ordering, no flow or congestion control. It suits applications that prefer speed to reliability or that do their own: DNS queries, DHCP, streaming media, online games, and QUIC (the transport under HTTP/3).

TCP

TCP (Transmission Control Protocol) gives a reliable, in-order, full-duplex byte stream between two processes, over a connection. It is byte-oriented: sequence numbers count bytes, not segments.

Sequence numbers in practice: if a segment has sequence number 1000 and carries 500 bytes, it holds bytes 1000–1499. The receiver acknowledges it with ACK 1500, meaning "send byte 1500 next". SYN and FIN each consume one sequence number even though they carry no data.

Connection setup: the three-way handshake

Each side picks a random initial sequence number (ISN), which protects against old duplicate segments and against attackers guessing numbers. After the handshake, the client's first data byte has sequence number x + 1.

A server that receives many SYNs and never the final ACK keeps half-open connections: this is the SYN flood attack, defended against with SYN cookies.

Connection release

Each direction is closed separately (half-close): a side sends FIN, the other ACKs it, and later sends its own FIN, which is ACKed. That makes four segments (three if the second ACK and FIN are combined). The side that closes first waits in the TIME_WAIT state for 2 × MSL (maximum segment lifetime) before forgetting the connection, so that a lost final ACK can be resent and old segments die out.

Flow control

The receiver advertises its free buffer space in the window field (rwnd). The sender keeps the amount of unacknowledged data at or below it. If the receiver advertises a window of 0, the sender stops and periodically sends a small window probe to learn when space frees up.

The window field is 16 bits, so the largest window is 65,535 bytes, and at most one window can be sent per RTT:

Maximum throughput ≤ window / RTT. With a 100 ms RTT that is 65,535 × 8 / 0.1 ≈ 5.24 Mbps, however fast the link. The window scale option multiplies the window by up to 2¹⁴ for fast, long links.

Sequence number wraparound

Sequence numbers are 32 bits, so they repeat after 2³² bytes. The wraparound time is 2³² bytes / bandwidth. It must be longer than the maximum segment lifetime, or an old segment could be mistaken for a new one.

• At 1 Gbps: 2³² × 8 / 10⁹ ≈ 34.4 s.
• At 10 Gbps: ≈ 3.4 s, shorter than a typical MSL of 120 s, so fast links use the timestamp option (PAWS) to tell old segments apart.

Socket programming

A socket is the interface an application uses to send and receive through the transport layer.

Here is a complete TCP server and client in one program. The server runs in a thread on the local machine and sends back each message in capitals:

import socket
import threading

server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)   # TCP
server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server.bind(("127.0.0.1", 0))        # port 0: let the OS choose a free port
server.listen(1)
port = server.getsockname()[1]

def serve():
    conn, _ = server.accept()        # one socket per connected client
    with conn:
        while data := conn.recv(1024):
            conn.sendall(data.upper())

thread = threading.Thread(target=serve)
thread.start()

with socket.create_connection(("127.0.0.1", port)) as client:   # handshake here
    for message in [b"hello", b"gate cs"]:
        client.sendall(message)
        print(client.recv(1024).decode())
thread.join()
server.close()

HELLO
GATE CS

A UDP version would use SOCK_DGRAM, skip listen, accept and connect, and use sendto and recvfrom, with each message an independent datagram.

Practice questions