TCP and UDP Principles

Role of the transport layer

In the TCP/IP model, the transport layer delivers data between applications on end hosts. IP gets packets to the correct device; transport gets bytes to the correct process using port numbers. HCIA-Datacom focuses on the two dominant transports: TCP and UDP.

A socket conversation is identified by the 4-tuple: source IP, source port, destination IP, destination port (plus protocol). Firewalls, ACLs, and NAT all key on these fields, so solid transport knowledge pays off far beyond this chapter.

TCP: Transmission Control Protocol

TCP is connection-oriented and reliable. Before useful data transfer, peers establish state. During transfer, TCP detects loss and corruption (via checksums and sequence tracking), retransmits, reorders, and regulates send rate to match the receiver.

Three-way handshake

Memorize the open sequence:

1. Client → Server: SYN (synchronize), proposes initial sequence number.
2. Server → Client: SYN-ACK (server SYN plus ACK of client’s SYN).
3. Client → Server: ACK.

Only after this exchange is the connection ESTABLISHED and bulk data transfer expected. Exam items often scramble the order or insert FIN too early—flag the correct SYN → SYN-ACK → ACK pattern.

Important TCP flags

Teardown commonly uses FIN/ACK exchanges from each side. RST appears when a port is closed, state is invalid, or a device actively refuses the session.

Reliability mechanisms

• Sequence numbers label bytes so the receiver can reassemble ordered streams and detect gaps.
• Acknowledgments confirm receipt of data up to a point (cumulative ACK behavior in classic TCP).
• Retransmission resends data that is not acknowledged within the retransmission timeout or via fast retransmit hints.
• Checksum covers header and data to catch in-transit corruption.

Reliability is end-to-end between hosts, not a guarantee that intermediate routers store and forward copies. Routers forward IP packets; TCP endpoints repair loss.

Flow control and windowing

The receiver advertises a window size—how many bytes it is willing to accept beyond the last acknowledged data. The sender must not exceed that window. As the receiver processes data and frees buffer space, it opens the window; if buffers fill, it shrinks or closes the window (window = 0) to pause the sender.

Sliding window allows multiple segments in flight, improving throughput on high-latency paths compared with stop-and-wait. Congestion control (slow start, congestion avoidance) further limits the sender when the network path is overloaded; HCIA expects conceptual awareness that TCP adapts, not deep Reno/CUBIC math.

TCP header overhead

A minimum TCP header is 20 bytes (more with options such as MSS, window scale, SACK, and timestamps). That overhead is justified when applications need an ordered byte stream: HTTP/HTTPS, SSH, Telnet, FTP control/data (classic modes), SMTP, and many database sessions.

UDP: User Datagram Protocol

UDP is connectionless and unreliable in the transport sense: no handshake, no ACK clock, no retransmission, no ordering, no flow control. Each datagram is independent.

Advantages:

• 8-byte header only (source port, destination port, length, checksum).
• Low latency and simple implementation.
• Application retains full control over timing and recovery.

Consequences:

• Datagrams may be lost, duplicated, or reordered.
• The application (or a higher protocol) must tolerate loss or implement its own recovery.

When UDP is the right choice

Some applications run reliability on top of UDP (for example, QUIC), but on HCIA you still classify the IP transport as UDP when the header says so.

Side-by-side comparison

Ports and multiplexing (preview)

Both TCP and UDP use 16-bit ports (0–65535):

• Well-known (0–1023): system services (HTTP 80, HTTPS 443, SSH 22, DNS 53, …).
• Registered (1024–49151): applications and vendors.
• Ephemeral/dynamic (49152–65535 commonly): client-side source ports (actual OS ranges vary).

A server listens on a well-known destination port; clients usually pick an ephemeral source port. The next section catalogs the port numbers H12-811 expects from memory.

Huawei operational touchpoints

Although TCP/UDP state machines run primarily on endpoints, network engineers still interact with them on VRP:

• ACLs match tcp or udp with source/destination ports for security policies.
• display tcp status (where supported) or session tables on security devices show established sessions.
• NAT/Easy IP translates address and port for many concurrent private hosts.
• Path MTU and ACLs that block ICMP can break TCP performance even when SYN succeeds—another reason ICMP knowledge from the previous section matters.

When testing services:

<Huawei> ping 10.1.1.1          # ICMP reachability only
<Huawei> telnet 10.1.1.1 22    # crude TCP port check if telnet client allowed

Ping success does not prove a TCP service is open; it only proves ICMP echo is answered. Conversely, a filtered ping with a working HTTPS service is common on hardened hosts.

Design and exam reasoning

Ask two questions for every scenario:

1. Must every byte arrive in order? → TCP.
2. Is occasional loss acceptable for lower delay/overhead? → UDP.

Exam traps:

• Calling UDP “reliable” because applications sometimes retry.
• Putting FIN before the three-way handshake completes.
• Assuming routers “run TCP” for ordinary packet forwarding—they route IP; TCP endpoints are usually the hosts (or the device when it is the Telnet/SSH/HTTP client or server).
• Confusing window size (flow control) with TTL (hop limit) or MSS (maximum segment size).

Linking forward

Transport choice reappears in:

• SSH vs Telnet management (both TCP; SSH preferred).
• FTP active/passive modes (TCP ports 20/21 patterns).
• DHCP (UDP 67/68) and DNS (UDP/TCP 53).
• SNMP (UDP 161/162).
• CAPWAP between fit APs and ACs (UDP 5246/5247) in the WLAN chapter.

If you can explain handshake, reliability, and the TCP/UDP trade-off in one clear paragraph, you are ready for port memorization and service troubleshooting next.