Compare TCP and UDP

IP gets a packet to a machine, on a best-effort basis. It makes no promises: packets can be lost, duplicated or arrive out of order, and it has no idea which program should get them. The transport layer deals with those two problems, and the two main protocols deal with them very differently.

A port is a 16-bit number that identifies a program's endpoint. Servers listen on well-known ports, such as 443 for HTTPS and 53 for DNS. Clients get a temporary port from the operating system.

A TCP connection is identified by four values: source address, source port, destination address and destination port. That's how a server handles thousands of connections on port 443 without confusing them.

TCP turns unreliable packets into a reliable, ordered byte stream. It numbers every byte, and the receiver acknowledges what has arrived, so lost data can be sent again and out-of-order data can be rearranged.

Before any of that, both sides have to agree on starting numbers. That's the three-way handshake.

Here is that same conversation in a real capture. [S] is SYN, [S.] is SYN-ACK, [.] is a plain ACK and [P.] is data being pushed to the application.

UDP adds ports and a checksum to IP, and almost nothing else. There's no handshake, no acknowledgement and no retransmission. Each datagram stands alone: it arrives whole or not at all.

That sounds worse, but it's the right choice when old data is useless. In a video call, a packet retransmitted half a second later would arrive after that moment has passed, so it's better to skip it and move on.