TCP and UDP are the two main transport protocols. TCP opens a connection and guarantees that data arrives complete and in order, retransmitting what's lost. UDP sends independent packets without setup or guarantees, which is faster and suits real-time traffic.
How it works
Both run on top of IP and use ports to reach the right app. The difference is what they promise.
TCP: a reliable stream
- A three-way handshake (SYN, SYN-ACK, ACK) sets up the connection.
- Data is numbered; the receiver acknowledges what it got.
- Missing data is retransmitted; data is delivered in order.
- Flow and congestion control slow the sender down when the receiver or network is overloaded.
The price is latency: the handshake costs a round trip, and one lost packet holds up everything behind it (head-of-line blocking).
UDP: fire and forget
UDP just sends datagrams. No handshake, no ordering, no retransmission. If a packet is lost, the application decides what to do, often nothing: in a video call, a late frame is useless anyway.
QUIC: the best of both
QUIC (used by HTTP/3) runs over UDP but adds reliability, encryption and multiple independent streams inside the application. That avoids TCP's head-of-line blocking and sets up encrypted connections faster.
Side by side
| TCP | UDP | |
|---|---|---|
| Connection setup | Three-way handshake | None |
| Delivery | Guaranteed, in order | Best effort, may arrive out of order |
| Retransmission | Automatic | Up to the application |
| Overhead | Higher (20+ byte header, ACKs) | Lower (8-byte header) |
| Typical uses | Web (HTTP/1.1, HTTP/2), email, SSH, file transfers | DNS, video and voice calls, games, QUIC/HTTP/3, streaming |
Examples
- Loading a web page over HTTP/2: TCP port 443.
- Looking up apple.com: a UDP query to port 53.
- A FaceTime call: UDP, because a retransmitted audio packet would arrive too late to play.
- YouTube in Chrome: QUIC over UDP port 443.
On a Mac
netstat -an -p tcp and netstat -an -p udp list each protocol's sockets. TCP sockets have states (LISTEN, ESTABLISHED, TIME_WAIT); UDP sockets have none, because UDP has no connections.
lsof -nP -iUDP shows which processes hold UDP sockets: mDNSResponder for DNS and Bonjour, Chrome for QUIC, FaceTime and other call apps.
See it in the app
LightAtom's connections view labels every row TCP or UDP. Unconnected UDP sockets, such as Chrome's QUIC traffic, are grouped into one row per app because they talk to many servers at once.
Frequently asked questions
Is UDP faster than TCP?
UDP has less overhead and no handshake or retransmission delays, so it has lower latency. TCP can still move bulk data efficiently; speed depends on the use.
Why does DNS use UDP?
A DNS question and answer usually fit in a single packet each, so a TCP handshake would double the time. DNS falls back to TCP for large answers.
Is HTTP/3 TCP or UDP?
HTTP/3 runs over QUIC, which runs over UDP. QUIC adds reliability and encryption on top of UDP itself.
Which is more secure, TCP or UDP?
Neither provides security on its own. Encryption comes from TLS (over TCP) or QUIC and DTLS (over UDP).