How to know whether a protocol uses TCP or UDP

Question

Well I know that might sound a stupid question and I believe that the most proper answer will be like I will be able to tell as my experience builds up and I learn more and more about the protocols.

However I am a student and I am not having much hands on experience in the field. Though I can google for any given protocol, I want to know if there is any rule of thumb. I still feel asking for "rule of thumb" is stupid, but still I am looking for one.

I encountered this list on wikipedia which lists the protocols and whether they use TCP or UDP in the tabular format. However I am not able to understand that what it means when the row for a particular protocol contains both TCP and UDP with single port number. For example, in Telnet row, it has 23-TCP-UDP. What does this mean? Telnet can operate on both TCP port 23 and UDP port 23?

Also I found that in my textbook, it says TFTP uses UDP, but if we look in the above table, TFTP line is 69-TCP-UDP. So just guessing whats going on in the above table.

Answer 1

You asked a good question. Don't let anyone tell you otherwise.

Regrettably, there is no rule of thumb for the types of protocols that use TCP versus the types of protocols that use UDP.

The decision whether a protocol uses one or the other comes down to whomever wrote/created the protocol to begin with.

If they didn't want to bother with writing their own "reliable delivery" system, then they can simply use TCP which provides all the reliability innately.

If they thought (knowing their own protocol innately) that they could write a better or more appropriate "reliable delivery" system, then they can build that into the protocol itself and simply use UDP as their transport.

As an example, take a look at a UDP TFTP sample capture, you'll notice that there are built in acknowledgement systems within TFTP itself -- having both those and the additional acknowledgement systems within TCP would simply be redundant.

Whereas FTP, which runs over TCP, does not have a built-in acknowledgement system. A user simply request a file, and the sender sends it. There is a "file transfer complete" notification, but nothing that guarantees having received each bit of the file. FTP is relying on TCP's reliability to ensure the file gets all the way across.

That said, I looked through the list of ports on the wiki page you linked, and saw a surprising amount of protocols that supposedly use TCP and UDP. This was foreign to me, and I only know of very few that use both (namely, DNS). But it may be that there is a TFTP implementation that uses TCP, and if so, I'm afraid I have no exposure to it.

Domain Name System (DNS) is traditionally the protocol referred to when discussing protocols that use both TCP and UDP. It doesn't use these at the same time, mind you. But different functions within DNS might call for TCP vs UDP.

For example, when making a simple A-record resolution request, the "request" and "response" are very lightweight, both requiring a single packet. As such, this is typically done over UDP.

But if a request or response requires a larger transfer (above a certain amount of bytes), then DNS chooses to use TCP to ensure "all the bits" get there. This is common with full Zone Transfer requests.

Answer 2

The Wikipedia page is not the best. IANA maintains the registry for port numbers (be warned, it is currently 138 pages): Service Name and Transport Protocol Port Number Registry

An application layer protocol is free to use any transport layer protocol and port number. By convention, most use specific port numbers in the registry, but that doesn't mean they can't use others, too. For instance, a web server will default to TCP port 80, but it can be set to use any other port number, and a web browser can still use it if given the port number on the URI.

There are many applications which can be set to use either TCP or UDP, and the port numbers can be changed. This offers some flexibility when dealing with conflicts and strange implementations.

Answer 3

In real life, you will find it is very easy to tell which transport protocol is used. Also, if you are looking for a "rule of thumb", then think of this:

UDP is a 'connectionless' / unreliable protocol, it does not recover lost packets like TCP does, and has much less overhead than TCP, so it is used as transport for applications that are sensitive to delay (like streaming audio / video).

TCP is a 'connection oriented' / reliable protocol, it recovers packets when they are lost, and has higher overhead, but is used where packet loss would cause issues.

Here are a number of methods you can use to determine in real life what transport layer protocol an application is using:

• Run netstat -an from a Windows command prompt.
• Download and run TCPView (which also lists UDP) for a GUI view.
• Run Wireshark
• Run nmap against the server with port in question (by default only scans TCP ports)

Answer 4

The source of the wikipedia list seems to be primerally https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt with the occasional line updated based on protocol specific references.

It looks like for older allocations both TCP and UDP port numbers were allocated to a protocol even if the protocol only actually used one or the other.For example FTP has entries in the IANA table for both TCP and UDP. These entries both reference RFC 959 but RFC 959 has no mention of UDP.

Generally the go-to resource for finding out what underlying protocols an application protocol actually uses would be the standard defining the protocol.

Some protocols can use either TCP or UDP either at user choice (for example NFS) or depending on the details of the request (for example DNS)