Study Guide
TCP, UDP, Ports and Sockets
How data reaches the right program on a device: port numbers, sockets, and the difference between TCP and UDP.
Lesson 3.8 Networking Fundamentals
An IP address gets data to the right device. But a device runs many programs at once, such as a browser, an email client and a chat app, and each needs its own data. This lesson, on the Transport layer, is about that final step and about how carefully the data is delivered.
Almost every security rule about network traffic is written in terms of these numbers: which ports are open, which are allowed through, and what normally runs on each. Knowing why ports exist and what TCP and UDP promise is the starting point for reading a firewall rule, a scan result or a log.
Stage: Think
Which program is it for?
Think it through
Your laptop has a web browser, an email app and a music app all using the internet at the same moment. Some data arrives, addressed to your laptop’s IP address. How could the laptop know which program the data is for?
- Hint 1: The IP address got the data as far as the laptop. What else would need to be written on it?
- Hint 2: Think of post arriving at a large building: what gets a letter to the right person inside?
Show what happens
The address on its own is not enough: it only reaches the laptop. The data also needs a second number saying which program it is for, and each program needs to claim a number of its own. That second number is called a port.
Stage: Explain
Why ports exist
Think of a block of flats. The street address gets a letter to the building. The flat number gets it to the right front door inside. Without the flat number, the post would sit in the hallway.
- The IP address is the building: it finds the device.
- The port number is the flat number: it finds the right program on that device.
A port is only a number carried with the data. It is not a physical socket in the wall or on a switch. Port numbers run from 0 to 65,535 (they are 16 bits long), and the two transport protocols in this lesson, TCP and UDP, each have their own separate set.
Think it through
Show the answer
Answer: A. They would not know which port to ask for, so they could not find the website.
Agreed numbers solve the problem: a visitor knows which door to knock on before they arrive.
Services wait on agreed port numbers, so that a device knows which “flat” to ask for. The common ones are:
| Service | What it does | Port | Transport |
|---|---|---|---|
| HTTP | Web pages, not encrypted | 80 | TCP |
| HTTPS | Web pages, encrypted | 443 | TCP (UDP in the newest version, HTTP/3) |
| DNS | Looks up the address that goes with a name | 53 | UDP/TCP |
| SSH | Signing in to another computer to type commands | 22 | TCP |
| DHCP | Hands out addresses automatically; the server uses 67 and the client 68 | 67/68 | UDP |
Port numbers fall into three ranges: 0–1023 (well-known, for standard services like those in the table), 1024–49151 (registered) and 49152–65535 (dynamic or private). The device that starts a conversation is called the client. It usually picks a temporary port from the high range for its own end, sometimes called an ephemeral port.
Where the comparison stops. A flat keeps its number for ever. A client’s port is chosen afresh for each conversation and given up when the conversation ends.
Check your understanding
Show the answer
Answer: C. No: 443 is the usual HTTPS port, but any service can use it.
Port numbers are conventions. A service can be configured on any port, so a well-known number tells you what to expect, not what is certainly there.
Stage: Discover
Sockets
If the port is the flat number, a socket is the open door with someone standing at it: the actual connection point that one program is holding open, through which it sends and receives. The operating system creates and manages it for the program.
A connection is identified by five things together: the source IP address and port, the destination IP address and port, and the transport protocol. An illustrative connection:
192.168.1.10:51542 → 203.0.113.10:443
That is a laptop at 192.168.1.10, using temporary port 51542, talking to a web server’s port 443.
Think it through
Show the answer
Answer: A. Each tab’s connection has its own temporary port.
Each tab’s connection is a separate socket with its own temporary port, so the replies are told apart by that port. The example below shows the two connections side by side.
Because every connection’s combination is different, one server port can handle thousands of clients at once.
A user opens the same website in two browser tabs, and the browser opens a separate connection for each.
- Tab 1 gets temporary port 51542:
192.168.1.10:51542 → 203.0.113.10:443. - Tab 2 gets temporary port 51543:
192.168.1.10:51543 → 203.0.113.10:443. - The server’s replies go back to port 51542 or 51543, so the laptop’s operating system hands each reply to the right socket, and so to the right tab.
- What changed? Only the source port. The addresses and the server port are identical, which is exactly why the source port matters.
Stage: Experiment
TCP and UDP
Getting data to the right program is one question. How carefully it is delivered is another.
Think it through
Show the answer
Answer: B. Skip it: by the time it was resent, the moment has passed.
Some jobs need every part, in order, whatever the delay; others would rather keep going. The Transport layer offers a protocol for each.
The Transport layer offers two main choices. TCP sets up a connection first and then guarantees that data arrives complete and in order, resending anything lost. UDP simply sends each message and moves on: no set-up, no guarantee, and much less overhead.
| Aspect | TCP | UDP |
|---|---|---|
| Connection | Established first, with a handshake | None: each message stands alone |
| Delivery | Reliable and in order, with retransmission | No guarantee of delivery or order |
| Overhead | Higher | Lower |
| Examples | HTTPS over HTTP/1.1 or HTTP/2, SSH | DNS queries, DHCP, HTTP/3 through QUIC |
TCP opens a connection with a three-way handshake. The three messages are named after the markers they carry: SYN (synchronise), SYN-ACK and ACK (acknowledge).
A simplified TCP exchange between a laptop and a web server. The first three messages are the three-way handshake.
- Step 1: Laptop to Web server. SYNI would like to open a connection.
- Step 2: Web server to Laptop. SYN-ACKAgreed, and here is my side of the connection.
- Step 3: Laptop to Web server. ACKConfirmed: the connection is open.
- Step 4: Laptop to Web server. DataThe request, carried in one or more segments.
- Step 5: Web server to Laptop. Acknowledgement and dataReceived data is acknowledged; lost segments are resent.
A simplified DNS lookup over UDP. There is no handshake; if a message is lost, the application must notice and try again.
- Step 1: Laptop to DNS server. QueryWhat is the address of www.example.com?
- Step 2: DNS server to Laptop. ResponseHere is the address.
Stage: Experiment
Try it: losing a part with TCP and UDP
Think it through
Choose a transport and what goes wrong on the way, then send. The list shows every message that crosses the network; below it is what the receiving program actually gets.
The message: Your exam results are ready
TCP, nothing goes wrong: what crosses the network
- Sender to receiver: SYN: asks to open a connection
- Receiver to sender: SYN-ACK: agrees
- Sender to receiver: ACK: connection open
- Sender to receiver: Segment 1 “Your”
- Sender to receiver: Segment 2 “exam”
- Sender to receiver: Segment 3 “results”
- Sender to receiver: Segment 4 “are”
- Sender to receiver: Segment 5 “ready”
- Receiver to sender: ACK: all 5 segments received
The program receives: Your exam results are ready
9 messages crossed the network. The program got the whole message, in order.
Compare all six cases in a table
| On the way | TCP | UDP |
|---|---|---|
| Nothing goes wrong | “Your exam results are ready” 9 messages | “Your exam results are ready” 5 messages |
| Part 3 is lost | “Your exam results are ready” 11 messages | “Your exam are ready” 5 messages |
| Parts 3 and 4 arrive in the wrong order | “Your exam results are ready” 9 messages | “Your exam are results ready” 5 messages |
A simplified model. Real TCP numbers its data in bytes, uses timers and acknowledges as it goes, and real programs that use UDP may add their own checks, as QUIC does. What it keeps is accurate: TCP delivers everything in order, at the cost of extra messages; UDP delivers what arrives, as it arrives.
UDP’s lack of guarantees is not a weakness for every job. For a quick lookup it is faster to simply ask again than to set up a connection. The newest version of the web’s protocol, HTTP/3, even runs over UDP, using a protocol called QUIC to add its own reliability and encryption on top, so “UDP” does not mean unreliable web pages.
Check your understanding
Show the answer
Answer: B. TCP, because it resends lost data and delivers it in order.
The file must arrive complete and in order, which is TCP’s guarantee. The extra messages are worth paying for.
Stage: Explain
Addresses, ports and sockets answer different questions
Five things in networking are called an address, a port or a socket. Each answers a different question.
| Identifier | Purpose | Example |
|---|---|---|
| IP address | Which device, anywhere in the world? | Laptop 192.168.1.10 |
| MAC address | Which device on this local network gets it next? | Illustrative interface 02:00:00:00:00:10 |
| TCP/UDP port | Which program on the device? | HTTPS server TCP 443 |
| Physical switch port | Which socket on the switch is the cable plugged into? | Laptop cable in port 5 |
| Socket | Which open connection point of which program? | The browser’s end of one connection |
The word “port” is the one that causes confusion, because it has two unrelated meanings. A laptop plugged into switch port 5 can use TCP port 51542 to contact TCP port 443 on a server. The 5 is a hole in a piece of hardware; 51542 and 443 are numbers in software. Neither has anything to do with the other.
A MAC address is not proof of identity: it can be set by the manufacturer, chosen by the device, randomised for privacy or copied by an attacker.
Check your understanding
Show the answer
Answer: B. No: port 5 is in a switch; 443 is a number in software.
The first is a physical switch port, a hole a cable plugs into. The second is a transport port, a number carried with the data. They are unrelated.
Firewall rules are usually written in terms of IP addresses, protocols and ports: “allow TCP 443 to the web server”. Knowing which service uses which port and transport is essential for reading and writing those rules, and for spotting traffic on ports where it should not be.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Compare it with the video call earlier in the lesson.
Show the answer
Answer: B. UDP: a lost update is soon replaced, so resending only adds delay.
Each update is quickly replaced, so resending a lost one would only make the game lag. UDP suits it; many games add their own checks for the few messages that must arrive.
Apply it
- Hint 1: Find the secure web service in the table of common ports.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: TCP/UDP ports are 16-bit logical identifiers.; A socket is an operating-system-managed software endpoint.; A physical switch port connects a device to the switch.
TCP/UDP ports distinguish transport endpoints and sockets provide software communication endpoints. Physical switch ports are interfaces. A conventional Layer 2 switch forwards using destination MAC information, not the TCP/UDP destination port.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: SYN → SYN-ACK → ACK
TCP uses SYN, SYN-ACK and ACK. DORA belongs to DHCP. ACK does not initiate this handshake; DNS, TLS and HTTP are distinct operations, not its three messages.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Study and revision
Practise ports, sockets and the TCP handshake through the Networking & Protocols topic.
Stage: Consolidate
What to remember
- The IP address finds the device; the port finds the program on it.
- Well-known ports are conventions, such as TCP 443 for HTTPS, not guarantees.
- A socket is one program’s end of one connection; the five-part combination of addresses, ports and protocol tells connections apart.
- TCP opens with a handshake and delivers everything in order, resending what is lost. UDP sends and moves on.
- A transport port is a number; a switch port is a socket in hardware.
Common misunderstandings
Transport ports are numbers in software. Physical switch ports are hardware interfaces; the two are unrelated.
Port numbers are conventions. A service can be configured on any port, so traffic on port 443 is not guaranteed to be HTTPS.
UDP itself makes no guarantees, but protocols built on it, such as QUIC for HTTP/3, add their own reliability and encryption.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 5 (see the Session 5 Learning Log): 16-bit logical ports, the common ports table, the three port ranges, sockets, the illustrative connection, the TCP three-way handshake, and logical versus physical switch ports.
- Moved from an earlier lesson: “Addresses, ports and sockets answer different questions” was previously part of What Is a Network? and keeps its heading and anchor here; its wording was simplified on 13 October 2026. It develops the additional educational explanations from my ChatGPT note-taking discussion.
- Supplementary explanation: the block-of-flats comparison, the “what it does” column of the ports table, the TCP and UDP comparison, the sequence diagrams, the note on UDP and QUIC, the two-tab example and the misunderstandings.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening question, every question asked in the lesson with its feedback and hints, the video-call, game and school examples, the TCP and UDP panel and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional, and the panel is a simplified model. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
An application-layer protocol that automatically provides IP configuration, such as an address, subnet mask, default gateway and DNS server information.
The system that translates domain names into IP addresses. It commonly uses port 53 over UDP and TCP.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
An entry in a firewall policy that combines conditions, such as source, destination, protocol and port, with an action: allow or deny.
The set of rules a web browser and a website use to ask for and send pages. A browser sends a request; the website sends a response.
HTTP protected by TLS. HTTP/1.1 and HTTP/2 commonly use TCP port 443, while HTTP/3 uses QUIC over UDP port 443.
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
The software that runs a computer and lets other programs use it. Windows, macOS, Linux, Android and iOS are operating systems.
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
An agreed set of rules for how data is formatted, transmitted and interpreted so that devices can communicate.
A software endpoint for network communication, managed by the operating system.
A protocol for signing in to another computer and typing commands on it over an encrypted connection. Administrators use it to manage servers and network devices remotely.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A connection-oriented transport protocol that starts connections with a SYN, SYN-ACK, ACK handshake and provides reliable, ordered delivery.
A connectionless transport protocol that sends datagrams without first establishing a connection or guaranteeing delivery.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.