CyberLabs
RR CYBERLAB • Networking

TCP vs UDP

Learn how TCP and UDP differ and how transport behavior helps analysts interpret network alerts.

QUICK READ

TCP provides connection-oriented delivery with sequencing and acknowledgements. UDP is connectionless and is common for services such as DNS. The protocol alone does not determine whether traffic is malicious.

Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.

TCP fundamentals

TCP establishes a connection using a handshake and maintains state. Analysts can examine connection attempts, successful sessions, resets, duration and byte counts.

UDP fundamentals

UDP sends datagrams without a TCP-style handshake. DNS, DHCP, NTP and many streaming or real-time applications use UDP.

What analysts check

  • Source and destination IP.
  • Source and destination port.
  • TCP or UDP.
  • Connection frequency and timing.
  • Bytes sent and received.
  • Whether the destination service is expected for the host.

Investigation example

A workstation making periodic TCP connections to the same external destination may deserve more attention when the process creating the connection is unusual. A burst of UDP DNS traffic can be normal or suspicious depending on the domain pattern, process and frequency.

Common mistakes

  • Calling all UDP traffic suspicious.
  • Ignoring the application or process that generated the traffic.
  • Assuming port numbers prove the service being used.

Daily quiz hook

Which transport protocol uses a connection-oriented handshake: TCP or UDP?

Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.

← Back to RR CyberLabs GuidesContact RR CyberLabs

Analyst practice note

TCP provides a connection-oriented stream with sequencing and retransmission, while UDP sends datagrams without those transport guarantees. Both can carry legitimate or suspicious services, and packet loss or sensor sampling can make observed conversations incomplete.

Inspect the synthetic protocol, ports, flags, and timing, then connect the flow to its application and host. Do not classify a connection from protocol alone; consider DNS, voice, streaming, telemetry, and application-specific behavior.

Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.