TCP vs UDP — What’s the Difference and Why It Matters

Every time data moves across a network, it uses one of two transport protocols. TCP is the reliable one; it makes sure every piece arrives, in order, with confirmation. UDP is the fast one; it sends data and moves on without looking back. Neither is better. They’re designed for different jobs, and understanding the difference is fundamental to cybersecurity work.

TCP - Transmission Control Protocol

TCP is all about reliability. Before sending data, it establishes a connection with a three-way handshake: the client sends a SYN, the server replies with a SYN-ACK, and the client confirms with an ACK. Every packet gets a sequence number. The receiver acknowledges what it got. Lost packets get retransmitted. Flow control adjusts speed based on what the receiver can handle. When done, a FIN handshake closes the connection cleanly.

Used by: web browsing (HTTP/HTTPS), email, file transfers, SSH, database connections, anything where losing a byte isn’t acceptable.

UDP - User Datagram Protocol

UDP is the opposite. No handshake. No connection. No confirmation. No retransmission. You send data and move on. Why? Speed. TCP’s reliability adds latency, and for some applications, speed matters more than perfection.

Used by: video streaming (a few dropped frames are invisible), online gaming (stale position data is useless), voice/video calls (a glitch beats a freeze), DNS queries (small and quick — just ask again if it fails). QUIC, which powers HTTP/3 and over 30% of web traffic in 2026, runs on UDP but adds its own reliability at the application layer.

Security implications

SYN Flood: Attacker sends thousands of SYN packets, never completing the handshake. Server allocates resources for each half-open connection until it’s overwhelmed. One of the oldest DDoS attacks. Defenses: SYN cookies, rate limiting, cloud DDoS protection.

UDP Amplification: Attacker sends small UDP requests with a spoofed source IP address. Servers send massive responses to the victim. A 60-byte query generates a 4,000-byte response multiplied across thousands of servers. DNS, NTP, and memcached are common amplification vectors.

Traffic Analysis: In logs, unexpected TCP connections to unusual ports may indicate reverse shells or C2 channels. Unusual UDP traffic could signal tunneling or exfiltration. SYN packets without ACKs indicate scanning or SYN floods. Nmap treats TCP and UDP scans differently. TCP scans use the handshake, and UDP scans are slower and less definitive.

Try it yourself

Open Wireshark and filter by TCPto watch three-way handshakes happen in real time. Filter by UDP watch DNS queries fire off instantly. Run netstat -an to see which protocols your machine is using right now. Try Nmap with -sT (TCP) and -sU (UDP) to feel the difference.

Bottom line

TCP: reliable, ordered, slower. UDP: fast, unconfirmed, lightweight. Every connection you analyze, every attack you investigate, and every firewall rule you write, you need to know which protocol you’re dealing with and why. The tradeoff between reliability and speed has security implications everywhere.