1

I learned that in a connection, when the packet arrives at the server, the server will need all the info from the 5-tuple to determine which application will get the package, namely

source ip, source port, destination ip, destination port, protocol(UDP or TCP).

Per my understanding, the source ip, the source port along with the destination port would be enough to determine the "source application"(since there could be only one app that can listen to a particular port at a certain time, if I am right) and the destination port should also tell which service we what from the server. Then I think these three pieces of info would suffice the need of determining which application at the server we should send the package to, then why the protocol and destination ip?

Thanks guys!

1
  • 2
    UDP/80 and TCP/80 are totally different things, handled by different applications. While UDP/53 and TCP/53 may be handled by the same application, they are very different protocols.
    – Ricky
    Sep 16 '18 at 7:01
4

Many transport-layer protocols (most prominently TCP and UDP) use port numbers and these are only valid for one protocol at a time. You could say there's a five-tuple, including the protocol number, but I'd prefer to say that each transport protocol has its own four-tuple (or some other scheme).

Actually, there is absolutely no tie between a TCP port and a UDP port of the same number. As Ricky's already pointed out, an application might use ports with the same number in both protocols but that is not too common.

Technically, the OS's IP implementation passes a packet's payload to the appropriate protocol handler for further processing - either TCP or UDP (or whatever is used) - completely ignoring the port number in the transport layer header. Accordingly, a UDP datagram addressed to UDP:80 could never find its way to a listener on TCP:80, nor could the TCP handler make any sense of it.

1

In addition to what was already pointed out by others: a host may have more than one IP address configured on an interface, and different applications can listen to the same port on the same interface, but on different IP addresses. So you need all five items in this tuple to distinguish traffic, especially when traffic is not initiated by the host and there is no state yet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.