US How TCP and UDP differ
TCP vs UDP is the choice between the two main transport protocols of the TCP/IP suite. Both sit on top of IP and both use port numbers to reach the right application, but they make opposite trade-offs between reliability and speed.
The Transmission Control Protocol (TCP), now defined in RFC 9293, opens a connection with a three-way handshake (SYN, SYN-ACK, ACK) before any data moves. It numbers every byte, expects acknowledgements, resends anything that goes missing and hands data to the application in the order it was sent. It also slows down when the receiver or the network cannot keep up, through flow control and congestion control.
The User Datagram Protocol (UDP), defined in RFC 768 in 1980, does none of that. Each datagram is sent on its own with an 8-byte header holding the ports, a length and a checksum. If a datagram is lost, duplicated or arrives out of order, UDP does not notice; the application has to cope. In return there is no connection set-up, no waiting for acknowledgements and no retransmission delay, and UDP can send to a broadcast or multicast address, which TCP cannot.
TCP and UDP compared
The table sums up the differences that matter when you choose a protocol or write a firewall rule.
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented, three-way handshake | Connectionless, no set-up |
| Delivery | Guaranteed: lost segments are resent | Best effort: lost datagrams stay lost |
| Ordering | In order, as a byte stream | No ordering, separate messages |
| Header size | 20–60 bytes | 8 bytes |
| Flow and congestion control | Yes | No, left to the application |
| Broadcast and multicast | No, one-to-one only | Yes |
| Latency | Higher, and a lost packet holds up the data behind it | Lower and more predictable |
| Typical uses | Web, file transfer, SSH, Modbus TCP, OPC UA, MQTT | DNS, NTP, SNMP, PTP, video streams, EtherNet/IP cyclic I/O |
One effect of TCP’s ordering is head-of-line blocking: when one segment is lost, everything behind it waits for the resend, even data that arrived safely. On a clean wired network this costs microseconds. On a congested link, Wi-Fi or a cellular connection it can add a noticeable delay, which is one reason HTTP/3 moved to QUIC, a newer protocol that runs over UDP.
Which industrial protocols use TCP and which use UDP
Industrial Ethernet uses both, often within the same protocol. As our guide to the TCP/IP model explains, they all ride on the same IP layer underneath.
-
//
Modbus TCP. TCP, port 502. A client polls a server and waits for each reply, so reliability matters more than speed. The move from serial is covered in our comparison of Modbus RTU and Modbus TCP.
-
//
EtherNet/IP. Both. Explicit messages for configuration and diagnostics use TCP port 44818. Cyclic I/O, called implicit messaging, uses UDP port 2222, often multicast, at a fixed requested packet interval.
-
//
OPC UA. Client-server sessions use TCP, port 4840 by default. OPC UA PubSub can instead publish over UDP multicast for one-to-many data, or through an MQTT broker over TCP.
-
//
MQTT. TCP, port 1883, or 8883 with TLS. It is the usual way to send machine data from an IIoT gateway to a broker or the cloud.
-
//
PROFINET and EtherCAT. Their real-time frames skip IP, TCP and UDP altogether and travel directly in Ethernet frames. PROFINET uses UDP only for set-up and diagnostics.
-
//
Video, time and monitoring. IP cameras usually control streams over RTSP on TCP and send the video itself as RTP over UDP. PTP (IEEE 1588), NTP and SNMP all use UDP.
Why cyclic control data uses UDP
It can look odd that I/O data, the most important traffic on a machine network, travels over the protocol that does not guarantee delivery. The reason is timing. A controller exchanging I/O every 10 ms has no use for a value that arrives 200 ms late after a retransmission; by then a newer value has already been sent. So EtherNet/IP and similar protocols send each update once over UDP, and the receiving device runs a timeout. If several updates in a row go missing, the connection faults and the machine goes to a safe state.
That design puts the reliability burden on the network instead. Industrial networks keep loss low with switched full-duplex links, VLANs to separate traffic, quality of service to prioritize control frames and managed industrial switches that stop multicast I/O flooding every port.
Firewalls, NAT and cellular links
The two protocols also behave differently at the edge of the network. A firewall can follow a TCP connection from handshake to close, so a rule that only allows connections opened from inside is simple to write. UDP has no connection to follow, so firewalls track it with timers, and multicast UDP usually cannot cross a router at all without extra configuration. When plant data has to leave site over 4G or 5G, a TCP-based protocol such as MQTT or OPC UA through an industrial IoT gateway is usually easier to secure and route than forwarding raw UDP.
Quick answers on TCP vs UDP
TCP and UDP: common questions
Is UDP faster than TCP?
It has lower latency, not more bandwidth. UDP skips the handshake, acknowledgements and retransmissions, so each message arrives sooner. On a clean network both can fill the same link.
Does DNS use TCP or UDP?
Mostly UDP, port 53. DNS switches to TCP for large responses and zone transfers, and resolvers are expected to support both.
Is HTTP TCP or UDP?
Both, depending on version. HTTP/1.1 and HTTP/2 run over TCP. HTTP/3 runs over QUIC, which uses UDP.
Does RDP use TCP or UDP?
Both, on port 3389. Remote Desktop sets up its session over TCP and uses UDP for screen and input traffic where the network allows it.
What is an advantage of UDP over TCP?
Low, predictable delay and multicast. UDP can send one stream to many receivers at once, and a lost packet never holds up the ones behind it.
We supply edge computers, IIoT gateways and managed switches with the protocol stack, firewall rules and VLANs set to your network plan as standard, so TCP and UDP traffic is separated and prioritized before the system ships.