TCP, UDP and ICMP

In one minute on Kite Studio's network, Asha downloads a font file, joins a video call and, when the call freezes, types ping to see whether the internet is up. Three different jobs, three different protocols. A lost byte ruins a font file; a late video frame is useless even if it arrives perfectly; and a network test does not need a conversation at all.

The rule

TCP: every byte, in order. UDP: fast, no promises. ICMP: the network's messages.

TCP (Transmission Control Protocol) is connection-based. Before any data, the two ends shake hands in three steps: SYN ("let's talk"), SYN-ACK ("agreed"), ACK ("starting"). After that, TCP numbers every byte, the receiver acknowledges what arrived, lost pieces are sent again, and the data is handed over complete and in order. TCP also slows down when the network is congested. Web pages, email, file transfers and SSH use TCP.

UDP (User Datagram Protocol) has no handshake and no retransmission. It sends each message (a datagram) and moves on. That makes it light and quick, and it suits traffic where late is as bad as lost: voice and video calls, online games, and small single-question exchanges like DNS lookups. If an application needs some reliability over UDP, it builds its own.

ICMP (Internet Control Message Protocol) carries messages about the network rather than user data: "destination unreachable", "time exceeded", and the echo request and reply that ping uses. traceroute also relies on ICMP messages. ICMP has no ports; it sits alongside IP rather than above it like TCP and UDP.

The shortcut

For any traffic, ask: "Would a missing piece be worse than a late piece?" Missing is worse → TCP. Late is worse → UDP. Is it a test or error report about the network itself, not user data → ICMP.

The trap is thinking UDP is "broken TCP". It is a deliberate choice: for real-time traffic, waiting for a resend makes things worse, not better.

Drills

Answer fast — trust the rule.

Remember

• TCP: every byte, in order. UDP: fast, no promises. ICMP: the network's messages.
• Ask whether a missing piece or a late piece is worse.
• TCP starts with SYN, SYN-ACK, ACK; ICMP has no ports.