Introduction to Internet Protocol, TCP, and UDP

Modern networks are architected to facilitate the transport of information between devices, handling a vast volume of data across various physical mediums.
Common network types include:
- Ethernet networks
- Wireless networks
- DSL (Digital Subscriber Line) networks
From the perspective of the Internet Protocol (IP), the specific method of transportation is secondary to the contents of the packets being transmitted across the network.

The network can be visualized as a series of highways or roads.
The Internet Protocol (IP) represents a truck driving across those roads.
Information is loaded into the IP truck at the source, sent across the network, and unpacked at the destination.
Inside the IP truck are boxes, which represent transport protocols like TCP or UDP.
Inside the TCP or UDP boxes resides the actual data or information intended for delivery.

Networking utilizes the concept of nesting information within other layers of information, known as encapsulation (adding layers) and decapsulation (removing layers).
An example of sending information to a web server from a laptop demonstrates this hierarchy:
- Ethernet Frame: The outermost layer when sending data over an ethernet network. It contains the Ethernet payload, an Ethernet header at the beginning, and a trailer at the end. These markers identify exactly where data begins and ends.
- IP Packet: Contained within the Ethernet payload. It consists of an IP header and an IP payload.
- TCP Segment: Contained within the IP payload. It includes a TCP header and a TCP payload.
- Application Data: Within the TCP payload is the specific application information, such as HTTP (Hypertext Transfer Protocol) data used for web server communication.
Different protocols may include even more layers of information that can be examined to understand the communication between two devices.

IP is the primary protocol for movement, but TCP and UDP are the most common protocols found within IP for transporting information.
TCP and UDP are frequently referred to as OSI Layer 4 (Transport Layer) protocols.
These protocols enable multiplexing, which allows different types of traffic to be sent across the network simultaneously from multiple devices and ensures they are properly received and differentiated on the other side.

TCP is defined as a connection-oriented protocol.
It requires a formal process to establish and terminate a conversation, similar to a phone call:
- Setup: One person dials a number, the other answers with "hello," and the first person responds with "hello" before the conversation begins.
- Teardown: At the end, both parties say "goodbye" before hanging up.
TCP provides reliable delivery, meaning the sender knows the information reached the destination.
Key features of TCP include:
- Acknowledgment Process: The receiver sends back an acknowledgment for every piece of data received, ensuring both sides know the transfer was successful.
- Error Recovery: If data is damaged or corrupted during transport, the receiving station notifies the sender, which then resends the data.
- Flow Control: The receiver can manage the rate of data transmission by telling the sender to speed up or slow down based on its capacity to process information.

UDP is a connectionless protocol, lacking formal setup or teardown procedures.
It is categorized as unreliable delivery because the sender receives no confirmation that the data arrived at the destination.
Characteristics of UDP include:
- No Acknowledgments: The receiver does not notify the sender of successful receipt.
- No Error Recovery: There is no mechanism to detect lost or corrupted data or to perform retransmissions.
- No Flow Control: The sender has no feedback regarding the receiver's status and cannot adjust the speed of the data transfer.
Advantages and Use Cases of UDP:
- Low Overhead: Without the need for setup, teardown, or acknowledgments, UDP is faster and more efficient for certain tasks.
- Real-Time Communication: Applications such as Voice over IP (VoIP) or video streaming use UDP. In real-time scenarios, lost data cannot be replayed or rewound; it is simply lost in time, and the conversation continues.
- Best Effort Protocols: Protocols requiring low overhead like DHCP (Dynamic Host Configuration Protocol) and TFTP (Trivial File Transfer Protocol) utilize UDP.

Even when using UDP, an application can manage its own reliability. The application itself tracks data flows and decides if retransmission is necessary, rather than relying on the transport protocol.
In VoIP, if data is lost, the application may do nothing, and the users may simply ask each other to repeat what was said.
Protocols that prioritize guaranteed delivery, such as HTTPS (Hypertext Transfer Protocol Secure) for web communication or SSH (Secure Shell) for terminal communication, rely on TCP to automatically manage data flow and retransmissions.

Every computer on a network has a unique IP address, functioning like a street address for a house.
When data arrives at a server's IP address, the system must determine which specific service should receive the data.
Port numbers function like room names in a house, directing incoming data to the correct application.
Communication requires three critical pieces of information for both the sender and the receiver:
1. The IP address.
2. The protocol (TCP or UDP).
3. The port number.

Port numbers range from $0$ to $65,535$ .
Nonephemeral Ports: These are permanent or well-known ports assigned to specific services. They are typically in the range of $0$ to $1,023$ , though some services use higher numbers permanently. Examples include web servers, email servers, and file servers.
Ephemeral Ports: These are temporary ports used by client devices. They are usually assigned randomly within the range of $1,024$ to $65,535$ . These ports are used for a single session and are closed once communication ends.

Port numbers provide reference for the operating system and are not intended as security mechanisms.
TCP and UDP have separate port number ranges. For example, TCP port $80$ is distinct and separate from UDP port $80$ .

A single client ( $10.0.0.1$ ) and server ( $10.0.0.2$ ) can maintain multiple simultaneous communications using different ports.
Example Scenario:
- Web Traffic: Uses TCP port $80$ (Destination) and a random ephemeral port such as $1,055$ (Source).
- VoIP Traffic: Uses UDP port $5,004$ (Destination) and a random ephemeral port such as $4,432$ (Source).
- Email Traffic: Uses TCP port $143$ (Destination) and a random ephemeral port such as $3,022$ (Source).
In a protocol decode, all these flows share the same Source IP ( $10.0.0.1$ ) and Destination IP ( $10.0.0.2$ ), but they are differentiated by their unique combinations of transport protocols and port numbers.
This structured process involving IP, TCP, and UDP allows every device on a network to communicate locally or across the internet efficiently.