Hot answers tagged

62

The standard ping command does not use TCP or UDP. It uses ICMP. To be more precise ICMP type 8 (echo message) and type 0 (echo reply message) are used. ICMP has no ports! See RFC792 for further details.


47

TCP is about as fast as you can make something with its reliability properties. If you only need, say, sequencing and error detection, UDP can be made to serve perfectly well. This is the basis for most real-time protocols such as voice, video streaming etc, where lag and jitter are more important than "absolute" error correction. Fundamentally, TCP says ...


23

IP is a Layer 3 protocol. TCP/UDP are Layer 4 protocols. They each serve different purposes. Layer 3 is in charge of end to end delivery. Its sole function is adding whatever is necessary to a packet to get a packet from one host to another. Layer 4 is in charge of service-to-service delivery. Its sole function is to segregate data streams. Your computer ...


16

While there is no formal "connection" with UDP there is still a convention that clients send requests and expect to get responses back with the source IP and port swapped with the Destinatoin IP and port. Stateful firewalls and NATs therefore assume that packets with a given combination of source IP/source port/Destination IP/Destination port and the ...


13

Because you're looking at the UDP Datagram, which is the payload in an IP Datagram. The IP Header has the src/dst IP addresses.


13

There's no such thing as "UDP ICMP "echo"". traceroute sends a UDP probe with an increasing TTL. That probe is a single datagram destined for a high port which is unlikely to be a listening service. As the datagram flows out across the network, the TTL decrements until it hits zero at which point an ICMP ERROR ("time exceeded") is generated. That ICMP ...


12

The answer is that it can be either broadcast or unicast - and in some cases both unicast and broadcast before it reaches the client when an ip helper-address is used. A client doesn't actually have an IP address until the DISCOVER-OFFER-REQUEST-ACK exchange is completed. It is possible (although very unlikely) to have a situation arise where the server ...


12

A switch learns the source MAC from the sender. If the destination is not in the CAM table, the switch floods the frame out all ports. So if the receiver never responds, the switch will never learn the receiver's MAC and it will always flood the frame.


11

Your firewall is maintaining a connection table for UDP connections. For example, when you send a DNS query, the firewall creates an entry for that flow so that the DNS reply will be allowed back into your network. The entries in the table time out after 30 seconds of no activity.


10

UDP is obviously a send-and-forget protocol. For example, during an NMap UDP scan, the only way to definitively prove that a UDP port is open is if you receive a response from that port. Keep in mind that many services may not reply to arbitrary data and require protocol or application-specific requets in order to warrant a response. Certain ICMP codes can ...


10

This is not the hosts that decide which route a packet will follow, each router in the path make it's own decision. (Actually, the originating host could use the IP strict source option to force the packets to go through a specific route, but it's rarely, if ever, used, and it's totally ignored by routers on the Internet) So each router can change the ...


10

UDP with reliability can indeed be a substitute for TCP. We already have an example of it: it's called QUIC. From Wikipedia: Among other applications, QUIC improves performance of connection-oriented web applications that are currently using TCP. It does this by establishing a number of multiplexed connections between two endpoints over User Datagram ...


9

Be aware of the broadcast flag, see RFC2131 (page 24): A client that cannot receive unicast IP datagrams until its protocol software has been configured with an IP address SHOULD set the BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or DHCPREQUEST messages that client sends. The BROADCAST bit will provide a hint to ...


9

Transport of both UDP and TCP packets from one router to the next is done at the IP layer and solely based on the information at this layer. This means, that there is no distinction between UDP and TCP and in both cases change of path, congestion or router hickups can cause loss, duplication or reordering of packets. But, contrary to UDP, TCP can deal with ...


9

You asked a good question. Don't let anyone tell you otherwise. Regrettably, there is no rule of thumb for the types of protocols that use TCP verses the types of protocols that use UDP. The decision whether a protocol uses one or the other come down to whomever wrote/created the protocol to begin with. If they didn't want to bother with writing their own ...


9

IP protocol build on Ethernet or something, Why an IP packet can be 65535 bytes when Ethernet can only send 1500 bytes? Ethernet is one of several physical layers which can be used to to transport IP (and also protocols besides IP). The size of the packet a physical layer can transport is specific to this physical layer, other physical layers have other ...


8

I would take a look at iperf. You should be able to use built in reporting in iperf to validate the amount of traffic dropped. iperf is typically ran across the network between two systems. I have iperf3 installed on two CentOS machines, as you can see below, one is configured as the server and the other the client. Install the iperf rpm, start the ...


8

Using a search for "linux ethernet packet generator" gives me packeth as the first hit. packeth Solution: Has both a GUI and CLI version Generates not only UDP, but many other protocols as well, including QinQ Is packaged for RedHat as an rpm, or Debian package netcat and tcpdump Solution: If it was me, I would just do a quick-and-dirty ten second netcat ...


8

This is a frequently asked question. The answer below is one of the best answers from another site. https://stackoverflow.com/questions/1099672/when-is-it-appropriate-to-use-udp-instead-of-tcp In situations where you really want to get a simple answer to another server quickly, UDP works best. In general, you want the answer to be in one response ...


8

To understand the mechanism, let's see it with an example: I issue a traceroute to 44.12.44.1 from my PC My PC sends 3 UDP datagrams to 44.12.44.1 with TLL=1 and port=33434 Inmediately sends 3 UDP datagrams to 44.12.44.1 with TTL=2 and port=33435 Inmediately sends 3 UDP datagrams to 44.12.44.1 with TTL=3 and port=33436 It will keep doing that until TTL=32 ...


8

Details vary but basically it goes something like. The two peers both open a UDP socket bound to a random local port The two peers both contact a server on the internet. This server responds and tells them what IP and port their packet was received from. Since the server is on the Internet the IP/port seen by the server is the external IP and port The two ...


8

A NAT router doesn't know when to remove a UDP mapping - it guesses. The router simply ages (or times) out the entry when it hasn't been using for a period of time (a few minutes usually). With TCP, there's also a similar aging/timeout to make sure that forgotten or lost sessions don't pile up but it's much longer. UDP or TCP aging is a trade-off between ...


7

It seems like a strange idea to transfer files using a connectionless protocol - so in what situation would you not care about if the entire file is delivered or not? I'm going to add a bit to YLearn's excellent answer... You always want the entire file delivered. Asserting that one doesn't want the whole file transferred because of TFTP is a faulty ...


7

The destination UDP port in the outer UDP header is specified in the VXLAN specification (Port 4789). This means it is a well-known service. So an UDP packet that arrives on Port 4789 is expected to be a VXLAN packet¹ in the same way that a TCP packet that arrives on Port 80 is expected to be a HTTP packet¹. The draft you linked to is outdated and is ...


7

Actually there is some truth in what the other person was saying, though it is largely false. Is it true (that packets in a TCP connection follow an established path)? Yes, in general, all packets in a TCP stream will follow the same path through the network - even in the presence of a "diamond" network, all packets in the same stream will be routed down ...


7

I am unable to throttle the network by submitting my UDP packets among such links because I worry about packet drops and message losses. At first blush, this sounds more like a design problem with the application, not the network: Networks are not reliable. UDP was never intended to transport messages reliably without adding application layer loss ...


7

This is a quick recipe: 1) Start a packet sniffer: sudo tcpdump -n -i eth2 icmp & [1] 1409 $ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes 2) Send an UDP packet: $ echo reply-me | nc -u 1.0.0.2 1000 3) If you receive 'ICMP port unreachable', that ...


7

UDP and TCP are completely separate Transport Layer (Layer 4 in the OSI model) protocols. There are also other layer-4 protocols, but TCP and UDP are the most commonly used. UDP was first, and it is a connectionless, unreliable, fire-and-forget protocol. TCP was added later to provide connections and reliability to layer 4. Layer-4 protocols have their own ...


7

This has nothing to do with security, TCP is a connection oriented protocol which means the communicating end points have to setup the communication channel (using a 3 way handshake) and has an acknowledgment mechanism to assure data transfer - also, lost segments will be retransmitted. Unlike UDP which is connection-less, meaning there is no communication ...


7

IP knows. For IPv4 there is a 8bit protocol field where 6 represents TCP and 17 UDP. In IPv6 there is an equivalent next-header. You can see all reserved protocol types here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml


Only top voted, non community-wiki answers of a minimum length are eligible