Computer Networking Cheatsheet

TCP and UDP

Use this Computer Networking reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

TCP vs UDP

	TCP	UDP
IP protocol number	6	17
Connection	handshake first	none, fire and forget
Header size	20-60 bytes	8 bytes
Ordering	guaranteed by sequence number	none
Retransmission	yes, on loss or timeout	none, the app must handle it
Flow control	receive window	none
Congestion control	yes (Reno, CUBIC, BBR)	none by default
Checksum	mandatory	optional in IPv4, mandatory in IPv6
Broadcast · multicast	no	yes
Head-of-line blocking	yes	no
Used by	HTTP/1.1 and /2, SSH, SMTP, TLS	DNS, DHCP, NTP, QUIC, VoIP, games

Pick TCP when every byte must arrive in order. Pick UDP when late data is worthless (live audio) or when you are building your own reliability on top, as QUIC does.

TCP header and flags

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-------------------------------+-------------------------------+
|         Source Port           |      Destination Port         |
+---------------------------------------------------------------+
|                    Sequence Number                            |
+---------------------------------------------------------------+
|                 Acknowledgment Number                         |
+-------+-----------+-----------+-------------------------------+
| Offs  |  Reserved |   Flags   |            Window             |
+-------+-----------+-----------+-------------------------------+
|          Checksum             |        Urgent Pointer         |
+-------------------------------+-------------------------------+
|                   Options (0-40 bytes)                        |
+---------------------------------------------------------------+

Flag	Name	Meaning
SYN	synchronize	open a connection, carries the initial sequence number
ACK	acknowledge	the ack field is valid, set on all but the first SYN
FIN	finish	no more data from this sender, graceful close
RST	reset	abort now, no port listening or state is gone
PSH	push	deliver to the app immediately, do not buffer
URG	urgent	urgent pointer valid, effectively unused
ECE / CWR	ECN	explicit congestion notification signalling

Three-way handshake

client                                     server
  |  SYN  seq=x, mss, wscale, sackok         |   CLOSED → LISTEN
  |----------------------------------------->|   SYN_RECEIVED
  |  SYN, ACK  seq=y, ack=x+1                |
  |<-----------------------------------------|
  |  ACK  seq=x+1, ack=y+1                   |
  |----------------------------------------->|   ESTABLISHED

Costs one round trip before any data moves, which is why TLS 1.3 over TCP needs 2 RTT to first byte and QUIC needs 1. TCP Fast Open can carry data in the SYN, and options negotiated in the handshake (MSS, window scaling, SACK, timestamps) cannot be changed later.

Teardown, TIME_WAIT, and RST

Graceful close is four packets, because each direction closes independently.

  |  FIN, ACK   |------>|   active closer → FIN_WAIT_1
  |  ACK        |<------|   passive → CLOSE_WAIT
  |  FIN, ACK   |<------|   passive → LAST_ACK
  |  ACK        |------>|   active → TIME_WAIT (2×MSL, 60 s on Linux)

State	Who holds it	What it means
`SYN_SENT`	client	SYN out, nothing back yet
`SYN_RECV`	server	half-open, piles up under SYN flood
`ESTABLISHED`	both	data flowing
`FIN_WAIT_1` / `_2`	active closer	waiting on the peer's FIN
`CLOSE_WAIT`	passive closer	app has not called close(), a code bug
`LAST_ACK`	passive closer	its FIN is out
`TIME_WAIT`	active closer	60 s guard against stale duplicates

Many CLOSE_WAIT sockets means your application leaks file descriptors. Many TIME_WAIT is normal on a busy client and only a problem when it exhausts the ephemeral port range.

A RST instead of a handshake means nothing is listening on that port, which is why ECONNREFUSED is instant while a filtered (dropped) port hangs until timeout.

Ports, ephemeral range, and well-known numbers

Ports are 16 bit, so 0-65535. IANA splits them into well-known (0-1023, needs root on Unix), registered (1024-49151), and dynamic (49152-65535).

Port	Service	L4
20, 21	FTP data, control	TCP
22	SSH, SCP, SFTP	TCP
25	SMTP	TCP
53	DNS	UDP and TCP
67, 68	DHCP server, client	UDP
80	HTTP	TCP
123	NTP	UDP
143, 993	IMAP, IMAPS	TCP
161	SNMP	UDP
389, 636	LDAP, LDAPS	TCP
443	HTTPS, HTTP/3 (QUIC)	TCP and UDP
587	SMTP submission	TCP
3306	MySQL	TCP
3389	RDP	TCP
5432	PostgreSQL	TCP
6379	Redis	TCP
27017	MongoDB	TCP

cat /proc/sys/net/ipv4/ip_local_port_range   # ephemeral range, 32768 60999
ss -tan state established | wc -l
ss -tulpn                                    # listening TCP and UDP with PIDs

A single client IP to a single server IP and port is capped by the ephemeral range, roughly 28,000 concurrent connections, because the 4-tuple must be unique.

Windows, congestion control, and the numbers that matter

Receive window is flow control (do not overrun the receiver). Congestion window is congestion control (do not overrun the network). The sender is limited by whichever is smaller.

Throughput on a lossless path is bounded by the bandwidth-delay product:

max in flight = bandwidth × RTT
1 Gbit/s × 80 ms = 10 MB must be in flight to fill the pipe

Window scaling (RFC 7323) is required above 64 KB, and it is negotiated only in the SYN. Middleboxes that strip the option cap you at 64 KB per RTT, which looks like a slow link on a fast one.

Algorithm	Signal it reacts to	Where it shines
Reno / NewReno	packet loss	historical baseline
CUBIC	loss, cubic growth	Linux default, high BDP
BBR	measured bandwidth and RTT	lossy or buffer-bloated paths

sysctl net.ipv4.tcp_congestion_control
sysctl -w net.ipv4.tcp_congestion_control=bbr
ss -ti                    # per-socket rtt, cwnd, retrans, pacing rate
nstat -az | grep -i retrans