# Transmission Control Protocol vs. User Datagram Protocol

At Layer 4 (the Transport Layer), the two dominant protocols are TCP and UDP. Understanding the difference is crucial for identifying how network attacks work and how Firewalls are configured.

## TCP (Transmission Control Protocol)
TCP is reliable, connection-oriented, and stateful. It guarantees that data will arrive, and in the correct order.

*   **The 3-Way Handshake:** Before ANY data is sent, TCP establishes a strict connection.
    1.  **SYN:** Client says "I'd like to talk to you."
    2.  **SYN-ACK:** Server says "Okay, I acknowledge your request, let's talk."
    3.  **ACK:** Client says "Great, I'm sending data now."
*   **Reliability:** Once connected, every time a computer sends a segment of data, the receiving computer must reply with an acknowledgment (ACK). If the sender doesn't get the ACK (because the packet dropped over Wi-Fi), it will automatically retransmit the data.
*   **Use Cases:** Web Browsing (HTTP/HTTPS), Email (SMTP), File Transfers (FTP/SMB), SSH. If a single byte is missing from a downloaded executable, the file breaks. TCP ensures every byte arrives.

## UDP (User Datagram Protocol)
UDP is unreliable, connectionless, and stateless. It just throws data at the destination and hopes it gets there.

*   **No Handshake:** UDP does not establish a connection first. It just starts sending packets immediately.
*   **No Acknowledgments:** If a packet gets dropped by a router on the internet, it's gone forever. UDP does not resend lost data.
*   **Why use it?** Speed and low overhead. Because there are no handshakes or ACKs, UDP is much faster.
*   **Use Cases:** Live Video Streaming (Zoom, Twitch), VoIP (Phone calls), DNS queries, Online Gaming. If you drop a single frame in a 60fps video game, it doesn't matter, you don't want the game to pause to re-download that old frame. You just proceed to the next current frame.

## Ports
Both TCP and UDP use **Ports** to direct traffic to the right application on a computer. A computer has 1 IP address, but can have up to 65,535 ports open simultaneously. 
*   If traffic arrives at IP 192.168.1.10 on TCP Port 80, the OS hands that data to the Web Server software.
*   If traffic arrives at TCP Port 22, the OS hands it to the SSH Server software.