Where the two transports sit
Both protocols live at Layer 4 of the TCP/IP model, directly above IP. IP moves a packet between hosts; the transport header adds a source and destination port so the receiving host knows which application gets the payload. Everything that separates TCP from UDP is what each one does between those ports.
In the blueprint this is v1.1 topic 1.5, inside the network components, cabling and TCP/UDP study area. Cisco’s v2.0 list gives the comparison no line of its own (what changes in v2.0), yet the ports still matter, because every service topic on either list runs over one transport or the other.
What TCP does for the application
Before any data moves, the two hosts trade SYN, SYN-ACK and ACK segments to agree on starting sequence numbers (RFC 9293). From then on each byte carries a sequence number, the receiver returns cumulative acknowledgments, and the sender retransmits anything left unacknowledged when its timer expires. The receiver also advertises a window: the number of bytes it can accept before the sender has to stop and wait. That window is TCP’s flow control, and it grows or shrinks with the conversation.
What UDP leaves to the application
UDP’s header holds four fields: source port, destination port, length and checksum (RFC 768). There is no session, no ordering and no retransmission. An application that needs any of those builds them itself, which is why a protocol can be important to the network and still run over UDP.
The two headers, behavior by behavior
| Behavior | TCP | UDP |
|---|---|---|
| Defined in (differs) | RFC 9293 | RFC 768 |
| Session setup (differs) | Three-way handshake (SYN, SYN-ACK, ACK) | None; the first datagram carries data |
| Ordering (differs) | Sequence numbers let the receiver reorder | None; datagrams arrive as they arrive |
| Lost data (differs) | Detected by missing acknowledgments, retransmitted | Not detected by the transport |
| Flow control (differs) | Receiver-advertised window | None |
| Header size (differs) | 20 bytes minimum, more with options | 8 bytes |
| Error check | Checksum | Checksum |
| Typical fit (differs) | Web pages, remote CLI, file copies, device admin | Short request/response, address leases, voice and video |
≠ marks rows where the two differ.
The checksum row is the one place the two agree: both detect a corrupted segment or datagram. Only TCP does anything about loss.
Service, transport, port
| Service | Transport | Port | Defined in |
|---|---|---|---|
| HTTP | TCP | 80 | RFC 9110 |
| HTTPS | TCP | 443 | RFC 9110 |
| SSH | TCP | 22 | RFC 4253 |
| TACACS+ | TCP | 49 | RFC 8907 |
| DNS | UDP for queries; TCP for zone transfers and large replies | 53 | RFC 1035 |
| DHCP | UDP | 67 server, 68 client | RFC 2131 |
| RADIUS | UDP | 1812 authentication, 1813 accounting | RFC 2865, RFC 2866 |
| CAPWAP (AP to WLC) | UDP | 5246 control, 5247 data | RFC 5415 |
SNMP, syslog, NTP and TFTP are left for the frames below. The SNMPv2c vs SNMPv3 page covers polling and notifications, and TACACS+ vs RADIUS explains why the two AAA protocols chose different transports.
Frames on TCP vs UDP
Name the transport before you read the options; most wrong answers here borrow one behavior from the other protocol. After answering, open the note under each option to see which behavior it borrowed.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 006 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 006
Which statement is true about the functionality of UDP?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
UDP has no acknowledgments or retransmissions, so any error recovery must come from the application above it.
Note on B
Correct: with no connection to set up, UDP can send one datagram to many receivers, which is why multicast and broadcast traffic rides on it.
Note on C
The three-way handshake (SYN, SYN-ACK, ACK) belongs to TCP; UDP just sends datagrams without any setup.
Note on D
Reliable, ordered delivery is what TCP’s sequence numbers and acknowledgments provide, and UDP offers neither.
Best answer: B · why
UDP (RFC 768) is connectionless: no handshake, no acknowledgments, no sequencing and no retransmission. That low overhead suits real-time traffic and lets one sender reach many receivers at once, so multicast and broadcast applications such as DHCP discovery and multicast video streams use UDP. Reliability and error recovery are TCP features (RFC 9293), or the application has to add them.
- Frame 002 of 006
Which of the following is a characteristic of TCP that makes it different from UDP?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: TCP’s receiver acknowledges the bytes it gets and the sender retransmits anything left unacknowledged, which UDP never does.
Note on B
Real-time voice and video usually prefer UDP, because a late retransmission is worse than a lost packet.
Note on C
Connectionless delivery with no handshake describes UDP; TCP opens every session with SYN, SYN-ACK, ACK.
Note on D
UDP’s 8-byte header is the lighter one; TCP’s header is at least 20 bytes and carries sequence and acknowledgment fields.
Best answer: A · why
TCP is connection-oriented and reliable: it numbers bytes with sequence numbers, the receiver acknowledges them, and the sender retransmits what is not acknowledged. UDP sends datagrams with no acknowledgments, no handshake and an 8-byte header. That makes it lighter and better for real-time traffic, but it leaves reliability to the application.
- Frame 003 of 006
Which protocol operates at the Transport layer and provides connectionless, unreliable data delivery?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
IP is connectionless and best-effort too, but it works at the Network layer, not the Transport layer.
Note on B
TCP is the Transport-layer protocol that does provide connections, acknowledgments and retransmission.
Note on C
ICMP carries error and diagnostic messages such as echo and unreachable, and it sits alongside IP at the Network layer.
Note on D
Correct: UDP is the connectionless Transport-layer protocol that sends datagrams without acknowledgments or retransmission.
Best answer: D · why
Two protocols live at the Transport layer in the CCNA scope: TCP and UDP. TCP is connection-oriented and reliable. UDP is connectionless and unreliable in the technical sense: it does not confirm delivery or resend lost data. IP is also best-effort, but it is a Network-layer protocol, and ICMP is a Network-layer helper for errors and diagnostics.
- Frame 004 of 006
Which statement correctly describes a characteristic of TCP compared to UDP?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
TCP is the protocol that confirms delivery with acknowledgments and resends lost segments; UDP is the one without that assurance.
Note on B
Correct: TCP exchanges SYN, SYN-ACK and ACK to open a connection before any data flows, while UDP sends immediately.
Note on C
TCP’s headers, handshake and acknowledgments add overhead, so UDP is the lighter of the two.
Note on D
VoIP normally runs over UDP (with RTP), since retransmitting a late voice packet does not help the call.
Best answer: B · why
Before TCP sends data, the two hosts complete a three-way handshake: SYN, SYN-ACK, ACK. It synchronizes sequence numbers and confirms both sides are ready. UDP has no setup step, which keeps its overhead low and makes it the usual choice for VoIP and other real-time traffic. TCP adds acknowledgments and retransmission, so it is the reliable but heavier option.
- Frame 005 of 006
What is the key difference between TCP port numbers and UDP port numbers?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: both protocols use the same 16-bit port field (0 to 65535); what differs is that TCP ports belong to connections and UDP ports do not.
Note on B
Both headers carry 16-bit source and destination port fields, so neither protocol uses 32-bit port numbers.
Note on C
Both protocols use the full 0 to 65535 range, and 0 to 1023 are well-known ports for either one, as DNS on TCP and UDP 53 shows.
Note on D
Ports are not tied to one kind of traffic: TCP carries far more than web pages, and UDP carries DNS, DHCP, SNMP and syslog besides media.
Best answer: A · why
TCP and UDP port numbers are both 16-bit values from 0 to 65535, split into well-known (0 to 1023), registered (1024 to 49151) and dynamic ranges. The same number can be used by both protocols independently, as DNS does with port 53. What differs is the transport behind the port: TCP sockets belong to connections set up by a handshake, while UDP sockets just send and receive datagrams.
- Frame 006 of 006
A network team is documenting the transport protocol and well-known port that each management service uses by default. Which pairing is correct?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
TFTP is the lightweight file transfer protocol that runs over UDP port 69 and handles its own simple acknowledgements.
Note on B
Classic syslog transport is UDP port 514. Syslog over TCP or TLS exists, but it uses other ports and is not the default.
Note on C
Correct. SNMP runs over UDP: managers poll agents on port 161 and agents send traps and informs to port 162.
Note on D
NTP exchanges time packets over UDP port 123. A TCP session would add delay that hurts the timing calculation.
Best answer: C · why
TCP adds a handshake, sequencing and retransmission; UDP (RFC 768) sends datagrams with none of that, which suits short request/response and one-way messages. Most device-management services therefore ride on UDP: SNMP uses port 161 for get/set requests to the agent and port 162 for traps and informs from the agent (RFC 3417), TFTP uses 69 (RFC 1350), syslog uses 514 (RFC 5426) and NTP uses 123 (RFC 5905). DNS is the usual exception people remember: UDP 53 for most queries, TCP 53 for zone transfers and large replies.
TCP and UDP, briefly
Does ping use TCP or UDP?
Neither. Ping sends ICMP echo requests, and ICMP rides directly on IP with no port numbers (RFC 792). A tool that checks whether a TCP port answers is a different test, usually built on the TCP handshake.
Can TCP and UDP both use port 443?
Yes. A TCP port and a UDP port are separate endpoints, so a host can listen on both at once. The service registry lists each transport separately for that reason.
Which layer adds the port numbers?
The transport layer, Layer 4 in both the OSI and TCP/IP models. IP addresses identify the host; ports identify the application on it, and the transport header is what carries both port numbers.
Primary sources
- [1]RFC 9293: Transmission Control Protocol (TCP)
- [2]RFC 768: User Datagram Protocol
- [3]RFC 2131: Dynamic Host Configuration Protocol
- [4]RFC 5415: CAPWAP Protocol Specification
- [5]Cisco Learning Network: CCNA v1.1 exam topicsChecked October 29, 2026.
- [6]Cisco Learning Network: CCNA v2.0 exam topicsChecked October 29, 2026.
Next on the map
One layer down, the same question of what gets marked and what travels bare comes back for Ethernet frames. The native VLAN vs access VLAN page follows the 802.1Q tag across a trunk.