TCP, UDP, HTTP and DNS: Network Protocols, Ports and How They Work · টিসিপি, ইউডিপি, এইচটিটিপি ও ডিএনএস: নেটওয়ার্ক প্রোটোকল, পোর্ট ও কার্যপ্রণালি

1. Protocols, ports and sockets

A protocol is an agreed set of rules (message formats, their order and the actions taken) that lets two programs or devices communicate. TCP stands for Transmission Control Protocol, so in a Bangla MCQ "TCP দিয়ে কী বোঝায়" the answer is simply "a protocol".

The protocols in this chapter sit in the top two layers of the TCP/IP model (see the OSI and TCP/IP models page for the layers themselves):

• the Transport layer: TCP and UDP, which carry data from one process to another;
• the Application layer: HTTP, DNS, DHCP, FTP, SMTP, POP3, IMAP and others, which define what the programs actually say.

IP delivers a packet to the right host (by IP address); the transport layer delivers it to the right program on that host (by port number). A port is a 16-bit number, so it runs from 0 to 65,535. An IP address plus a port, such as 192.0.2.10:443, is a socket address. IANA divides the port space into three ranges:

Range	Name	Used for
0 – 1023	Well-known (system) ports	Standard server services (HTTP 80, DNS 53 …)
1024 – 49151	Registered (user) ports	Applications registered with IANA (e.g. RDP 3389, MySQL 3306)
49152 – 65535	Dynamic / private (ephemeral) ports	Temporary client-side ports chosen by the operating system

2. TCP vs UDP

Point	TCP	UDP
Connection	Connection-oriented (handshake first)	Connectionless (just send)
Reliability	Reliable: acknowledgements, retransmission, checksum	Unreliable ("best effort"): checksum only (optional over IPv4, mandatory over IPv6), no retransmission
Order	Delivers bytes in order	No ordering
Flow and congestion control	Yes (sliding window, congestion window)	No
Data unit	Segment; a byte stream with no message boundaries	Datagram; each message kept whole
Header size	20 – 60 bytes	8 bytes (fixed)
Speed and overhead	Slower, more overhead	Faster, very little overhead
Delivery modes	Unicast only (one-to-one)	Unicast, broadcast and multicast
Typical users	HTTP/1.1 and HTTP/2, HTTPS, FTP, SMTP, POP3, IMAP, SSH, Telnet	DNS queries, DHCP, SNMP, TFTP, NTP, VoIP and video (RTP), online games, QUIC (HTTP/3)

Rule of thumb: choose TCP when every byte must arrive correctly (web pages, files, email); choose UDP when speed matters more than a lost packet, or when a reply is a single small message (live voice and video, DNS lookups, DHCP). An exam phrasing such as "which transport protocol avoids retransmitting lost packets" or "sends data over an unprotected system" points to UDP.

3. Opening and closing a TCP connection

Three-way handshake (connection set-up). The two sides agree on starting sequence numbers:

1. Client → server: SYN, seq = x (the client's initial sequence number).
2. Server → client: SYN + ACK, seq = y, ack = x + 1.
3. Client → server: ACK, seq = x + 1, ack = y + 1. The connection is open.

Four-way teardown (closing). TCP is full duplex, so each direction is closed separately: FIN, ACK, FIN, ACK. The side that closes first waits in TIME-WAIT for twice the maximum segment lifetime before forgetting the connection. If the second side has nothing more to send, it may combine steps 2 and 3 into one FIN + ACK, giving three segments; exams still expect "four-way" by default. A RST segment aborts a connection at once.

Worked example 1: sequence and acknowledgement numbers. A client's initial sequence number is 1000; the server's is 5000. The client then sends 1,500 bytes of data in three segments of 500 bytes.

1. SYN: seq = 1000. The SYN flag uses up one sequence number even though it carries no data.
2. SYN-ACK: seq = 5000, ack = 1001.
3. ACK: seq = 1001, ack = 5001.
4. Data segments: seq = 1001, 1501 and 2001 (TCP numbers bytes, not segments).
5. After receiving all three, the server sends ack = 2501, the number of the next byte it expects.
6. If the segment starting at 1501 were lost, the server would answer the segment at 2001 with a duplicate ack = 1501. Only one duplicate is possible here, so the client waits for its retransmission timeout. Had the client sent at least three more segments after the lost one, three duplicate ACKs (ack = 1501) would make it retransmit at once (fast retransmit) without waiting for the timer.

TCP header flags. The classic six are URG, ACK, PSH, RST, SYN and FIN (ECE and CWR were added for congestion signalling). The 16-bit Window field carries rwnd, which is why the window without scaling is at most 65,535 bytes. A SYN flood attack sends many SYNs and never completes the handshake, filling the server's table of half-open connections; SYN cookies are a common defence.

4. Flow control vs congestion control

Both slow the sender down, but for different reasons, and exams love to mix them up.

	Flow control	Congestion control
Protects	The receiver (its buffer)	The network (routers and links)
Window	Receive window rwnd, advertised by the receiver in every segment	Congestion window cwnd, worked out by the sender itself
Mechanism	Sliding window	Slow start, congestion avoidance (AIMD), fast retransmit and fast recovery

The sender may have at most min(rwnd, cwnd) unacknowledged bytes in flight.

Sliding window. Suppose rwnd = 4,000 bytes and each segment holds 1,000 bytes. The sender may send bytes 1 – 4,000 without waiting. When "ack = 2001, rwnd = 4000" arrives, the window slides forward to cover bytes 2,001 – 6,000, so bytes 4,001 – 6,000 may now go. A receiver whose buffer is full advertises rwnd = 0 and the sender stops.

Congestion control (simplified). cwnd starts at 1 segment and doubles every round-trip time (slow start) until it reaches the threshold ssthresh, then grows by one segment per RTT (congestion avoidance, additive increase). With ssthresh = 8 the window goes 1, 2, 4, 8, 9, 10, 11, 12 … If a timeout happens at cwnd = 12, ssthresh becomes 12 ÷ 2 = 6 and cwnd falls back to 1 (multiplicative decrease). After three duplicate ACKs, TCP Reno instead halves the window and carries on (fast recovery), while the older TCP Tahoe treats every loss like a timeout and restarts from cwnd = 1. (Standards today allow an initial window of 2 – 4 segments, or up to 10, but exam questions start from 1.)

Worked example 2: the window limits throughput. A TCP connection without window scaling can advertise at most 65,535 bytes. With a round-trip time of 100 ms the best possible throughput is window ÷ RTT = 65,535 × 8 bits ÷ 0.1 s ≈ 5.24 Mbps, however fast the link is. To fill a 100 Mbps path with a 50 ms RTT, the window must hold the bandwidth-delay product: 100 × 10⁶ × 0.05 = 5,000,000 bits = 625,000 bytes, which is why TCP has a window-scale option.

5. HTTP and HTTPS

HTTP (HyperText Transfer Protocol) is the request-response protocol of the web: the browser sends a request (method, URL, headers, optional body) and the server returns a status code, headers and the content. HTTP is stateless: the server remembers nothing between requests by itself, so logins and carts are kept with cookies or tokens. Default port: TCP 80.

Method	Purpose	Safe?	Idempotent?
GET	Fetch a resource	Yes	Yes
HEAD	Same as GET but headers only	Yes	Yes
POST	Submit data or create something	No	No
PUT	Create or replace the resource at a URL	No	Yes
PATCH	Change part of a resource	No	Not necessarily
DELETE	Remove a resource	No	Yes
OPTIONS	Ask which methods are allowed	Yes	Yes

Status class	Meaning	Common codes
1xx	Informational	100 Continue, 101 Switching Protocols
2xx	Success	200 OK, 201 Created, 204 No Content
3xx	Redirection	301 Moved Permanently, 302 Found, 304 Not Modified
4xx	Client error	400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found
5xx	Server error	500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable

Versions. HTTP/1.0 opened a new TCP connection per request; HTTP/1.1 keeps connections open (persistent) and requires the Host header; HTTP/2 multiplexes many requests over one TCP connection in binary frames; HTTP/3 runs over QUIC, which uses UDP.

SSL, TLS and HTTPS. TLS (Transport Layer Security) encrypts and authenticates a connection; SSL (Secure Sockets Layer) is its older predecessor, and every SSL version and TLS 1.0/1.1 are now deprecated, so "SSL certificate" today really means a TLS certificate. TLS 1.3 (2018) is current. HTTPS (HyperText Transfer Protocol Secure) is simply HTTP sent inside a TLS connection, on TCP 443:

1. TCP three-way handshake to port 443.
2. TLS handshake: the client and server agree on algorithms, the server proves its identity with a certificate signed by a trusted certificate authority (CA), and both derive shared session keys (public-key cryptography is used only for this step).
3. HTTP requests and responses then travel encrypted with fast symmetric encryption, protected against eavesdropping and tampering.

	HTTP	HTTPS
Port	80	443
Encryption	None (plain text)	TLS
Server identity checked	No	Yes, by certificate
URL	http://	https:// (padlock in the browser)

6. DNS: from names to addresses

The Domain Name System is a distributed, hierarchical database that translates names such as www.example.com into IP addresses (forward lookup) and back (reverse lookup). Port 53: queries normally use UDP; TCP is used for zone transfers between servers and for replies too large for one UDP message (the classic limit is 512 bytes; the EDNS extension raises it). That is why "which service uses both TCP and UDP" is keyed DNS.

The hierarchy is read right to left: the unnamed root (".") → top-level domains (TLDs: .com, .org, .bd) → second-level domains (gov.bd, example.com) → hosts (www). There are 13 named root server identities (A to M), each run as many copies around the world.

The players. A resolver is the DNS client (asked in MCQs: "a DNS client is called a resolver"); a recursive resolver (your ISP's or a public one) does the searching; authoritative servers hold the official records for a zone.

Recursive vs iterative. In a recursive query the server must return the final answer (or an error). In an iterative query a server returns the best it knows, usually a referral: "ask this server next". Normally your computer asks its resolver recursively, and the resolver asks root, TLD and authoritative servers iteratively.

Caching. Every record has a TTL (time to live) in seconds; resolvers keep answers until it expires. An answer that comes from a cache is called non-authoritative; one from the zone's own server is authoritative. A DNS server holds or looks up records and answers others; a DNS cache (in the browser, the operating system or the resolver) just stores recent answers so repeat lookups are instant and the servers carry less load.

Record	Maps	Example use
A	Name → IPv4 address	www → 192.0.2.10
AAAA	Name → IPv6 address	www → 2001:db8::10
CNAME	Alias → canonical name	shop → www.example.com
MX	Domain → its mail server (with a preference number)	Where to deliver email for @example.com
NS	Zone → its authoritative name servers	Delegating a domain
PTR	IP address → name (reverse lookup)	10.2.0.192.in-addr.arpa → www.example.com
SOA	Zone → administrative data (serial, timers)	Start of a zone
TXT	Name → free text	SPF and domain verification

Worked example 3: forward and reverse lookup. Forward lookup: nslookup www.example.com (or dig www.example.com A) asks for the A record and returns the address. Reverse lookup of 192.0.2.10: reverse the octets and add the special domain, giving 10.2.0.192.in-addr.arpa, then ask for its PTR record (nslookup 192.0.2.10 does this for you). Both use port 53, normally over UDP.

7. DHCP: automatic IP configuration

Configuring every computer by hand is slow and error-prone (typing mistakes, duplicate addresses, re-work when the network changes). The Dynamic Host Configuration Protocol lends a host an IP address for a limited time (a lease) together with the subnet mask, default gateway and DNS servers. It runs over UDP: server port 67, client port 68, and grew out of the older BOOTP (it uses the same ports and message format).

The four messages spell DORA:

1. Discover: the client, which has no address yet, broadcasts from 0.0.0.0 to 255.255.255.255 to find a server.
2. Offer: a server offers an address and settings.
3. Request: the client asks for the offered address (still broadcast, so other servers learn their offers were declined).
4. Acknowledge: the server confirms and the lease starts.

The client tries to renew at half the lease time (T1) and again at 87.5 % (T2). Because routers do not forward broadcasts, a network without its own server needs a DHCP relay agent on the router. If no server answers, Windows and many other systems give themselves a 169.254.x.x link-local address (see IP addressing).

8. FTP and the email protocols

FTP (File Transfer Protocol) uses TCP with two connections: port 21 for control (commands and replies) and a separate data connection. In active mode the server opens the data connection from its port 20 to the client; in passive mode the client opens it to a port the server names, which works better through firewalls and NAT. FTP sends passwords in plain text; SFTP (file transfer over SSH, port 22) and FTPS (FTP over TLS) are the secure options. TFTP is a tiny file transfer protocol over UDP 69 with no login.

Email uses different protocols for sending and for reading:

Protocol	Job	Port (plain / TLS)	Transport
SMTP (Simple Mail Transfer Protocol)	Sends (pushes) mail: client → server and server → server	25 between servers; 587 for client submission; 465 with implicit TLS	TCP
POP3 (Post Office Protocol 3)	Receives: downloads mail to one device, usually removing it from the server	110 / 995	TCP
IMAP (Internet Message Access Protocol)	Receives: keeps mail and folders on the server, synchronised across all devices	143 / 993	TCP

So SMTP and IMAP differ in purpose: SMTP moves mail towards the recipient's server; IMAP lets the recipient read and organise it there. A webmail user reads mail over HTTP(S), not POP3 or IMAP.

9. Other protocols exams ask, and the port table

• ICMP carries error and test messages for IP: "destination unreachable", "time exceeded". ping uses ICMP echo request and echo reply; traceroute (tracert on Windows) uses the TTL and "time exceeded" replies to list the routers on a path. ICMP has no port numbers.
• ARP finds the MAC address for an IP address on the local network (its layer is discussed on the OSI page).
• SNMP monitors and manages network devices (UDP 161, traps on 162); too-frequent polling can overload a managed device's CPU.
• NAT/PAT: a home or office router lets many private hosts share one public IP address by rewriting each outgoing connection's source address and port (port address translation, also called NAT overload) and keeping a table to send replies back to the right host.
• SSH is the encrypted replacement for Telnet; IPsec encrypts at the network (IP) layer; RTP carries voice and video for VoIP; IGMP manages multicast group membership.
• A routed protocol carries user data and is routed (IP); a routing protocol lets routers exchange routes (RIP, OSPF, BGP); see routing and switching.

Port	Protocol	Transport
20, 21	FTP (data, control)	TCP
22	SSH, SFTP	TCP
23	Telnet	TCP
25	SMTP	TCP
53	DNS	UDP and TCP
67, 68	DHCP (server, client)	UDP
69	TFTP	UDP
80	HTTP	TCP
110	POP3	TCP
123	NTP	UDP
143	IMAP	TCP
161, 162	SNMP (queries, traps)	UDP
179	BGP	TCP
389	LDAP	TCP (UDP also registered)
443	HTTPS	TCP (UDP for HTTP/3)
520	RIP	UDP
993, 995	IMAPS, POP3S	TCP
3389	RDP (Remote Desktop)	TCP

10. Tricky exam cases

• "Which protocol uses both TCP and UDP?" DNS (port 53). Do not pick HTTP: classic HTTP is TCP-only, though HTTP/3 uses UDP through QUIC.
• "DHCP Discover is a … message." Broadcast (the client has no address and does not know the server's).
• "Which protocol does ping use?" ICMP, not TCP or UDP.
• Header sizes. UDP 8 bytes; TCP 20 – 60 bytes; the IPv4 header is also 20 – 60 bytes (its length field counts 4-byte words, maximum 15 × 4 = 60).
• Email activities. Sending from a mail client to a server: SMTP. Downloading to a desktop client: POP3 (or IMAP). Reading in a browser: HTTP. So "A1 SMTP, A2 POP, A3 HTTP".
• Queuing delay. A router sends at 1 Gbps and 10 packets of 1,200 bytes arrive together. The 10th waits for the 9 ahead of it: 9 × 1,200 × 8 ÷ 10⁹ s = 86.4 µs.
• Packetization delay. A voice source produces 128 kbps. Filling a packet with 1,500 bytes of data takes 1,500 × 8 ÷ 128,000 s = 93.75 ms, which is why voice uses small packets despite the header overhead.
• Port ranges. 1023 is the last well-known port and 49152 the first dynamic port; ports are 16-bit, so 65535 is the highest.