Transport Layer

The transport layer connects application endpoints across an IP network. TCP and UDP both use 16-bit port numbers, but they expose different communication models and guarantees to applications.

Ports and Sockets

A destination port helps the operating system deliver traffic to a listening socket. A connection or flow is identified by more than one port: protocol, source and destination addresses, and source and destination ports all matter. The same server port can therefore support many simultaneous clients.

TCP Byte Streams

TCP provides an ordered, reliable byte stream while a connection remains viable. It uses sequence numbers, acknowledgements, retransmission, flow control, and congestion control. TCP does not preserve application message boundaries: one write can arrive through several reads, or several writes can be returned by one read. Applications define their own framing.

Reliability is not absolute delivery. A connection can time out, reset, or fail, and an acknowledgement does not prove that an application durably committed the data.

The TCP Handshake

A normal TCP connection begins with a three-way handshake:

1. The initiator sends SYN with its initial sequence information.
2. The listener replies SYN-ACK with its own sequence information and acknowledgement.
3. The initiator returns ACK.

This establishes transport state in both endpoints. It does not authenticate the application server or prove that the requested application operation will succeed.

UDP Datagrams

UDP preserves datagram boundaries and provides checksum-based error detection, but it does not provide TCP-style connection state, ordering, retransmission, flow control, or congestion control. An application can add any needed reliability or congestion behavior itself. UDP is not automatically faster; performance depends on protocol design, workload, path, and implementation.

Inspecting Transport Endpoints

Use ss to inspect listening and connected sockets without changing them:

$ ss -lntup
$ ss -tn state established

Process details can require privileges. A listening socket proves local readiness only at the transport boundary; firewall, routing, address family, TLS, and application health still need appropriate tests.

Summary

You can now distinguish TCP stream behavior from UDP datagram behavior.

1. Identify a flow using protocol, addresses, and ports.
2. Treat TCP as a reliable ordered byte stream without message boundaries.
3. Recognize what the TCP handshake does and does not prove.
4. Treat UDP reliability and congestion behavior as application design choices.
5. Verify application health beyond local socket state.