Stage 3 · Build
TCP/IP Fundamentals
UDP & ICMP
When to use UDP, ICMP messages, ping, traceroute internals.
UDP: Simple and Fast
UDP (User Datagram Protocol) sends datagrams without establishing a connection. No handshake, no sequence numbers, no acknowledgments, no ordering. It is a thin wrapper around IP that adds port numbers and a checksum.
UDP Header (8 bytes):
+------------------+------------------+
| Source Port | Destination Port |
+------------------+------------------+
| Length | Checksum |
+------------------+------------------+
TCP Header (20+ bytes):
+------------------+------------------+------------------+
| Source Port | Destination Port | Seq Number |
+------------------+------------------+------------------+
| Ack Number | Offset | Flags | Window |
+------------------+------------------+------------------+UDP is 8 bytes of overhead vs TCP's 20+ bytes. That simplicity is the point — there is nothing to negotiate, no state to maintain.
When to Use UDP
UDP is chosen when you need speed over reliability, or when the application handles its own reliability. DNS queries, video streaming, VoIP, gaming, and QUIC (HTTP/3) all use UDP.
| Protocol | Transport | Why UDP |
|---|---|---|
| DNS | UDP (and TCP for large responses) | Small request/response, low latency |
| QUIC/HTTP3 | UDP | Built-in reliability, avoids head-of-line blocking |
| VoIP/RTP | UDP | Real-time audio cannot wait for retransmits |
| Game state | UDP | Latest state matters more than reliable delivery |
| Wireguard | UDP | Encrypted tunnel, simplicity matters |
UDP does not guarantee delivery, but many UDP-based protocols implement their own reliability. QUIC, for example, adds streams, acknowledgments, and retransmission on top of UDP. The advantage is control — you choose exactly when and how to retransmit.
ICMP: The Network Messenger
ICMP (Internet Control Message Protocol) operates at Layer 3 alongside IP. It is not a transport protocol — it does not carry application data. Instead, it reports errors, diagnostics, and network conditions.
| ICMP Type | Code | Meaning |
|---|---|---|
| Echo Request | 0 | Used by ping |
| Echo Reply | 0 | Response to ping |
| Destination Unreachable | 3 | Packet cannot reach destination |
| Time Exceeded | 11 | TTL expired (used by traceroute) |
| Redirect | 5 | Better route available |
| Source Quench | 4 | Deprecated — congestion notification |
# See only ICMP packets
sudo tcpdump -i eth0 icmp
# Ping a specific host and count responses
ping -c 4 8.8.8.8
# Ping with specific packet size
ping -s 1400 -c 3 example.comICMP messages are encapsulated directly in IP packets. They do not use TCP or UDP ports. Many firewalls block ICMP echo requests (ping) but allow ICMP time exceeded and destination unreachable.
Ping Deep Dive
Ping sends ICMP Echo Request and waits for Echo Reply. It measures round-trip time (RTT) and reports packet loss. Simple but powerful for basic connectivity testing.
# Continuous ping with timestamps
ping -D 8.8.8.8
# Ping with specific interval (flood ping, needs root)
sudo ping -i 0.01 -c 100 8.8.8.8
# Set packet size (useful for MTU testing)
ping -M do -s 1472 -c 3 8.8.8.8
# Trace path (like traceroute but using ping)
ping -R example.comThe -M do -s 1472 combination tests if a 1500-byte packet (1472 + 28 bytes of headers) can pass without fragmentation. If it fails, your path MTU is lower than 1500.
How Traceroute Works
Traceroute exploits the TTL (Time To Live) field in the IP header. It sends packets with incrementally increasing TTL values. Each router along the path decrements the TTL by 1. When TTL reaches 0, the router sends back an ICMP Time Exceeded message.
# Standard traceroute
traceroute example.com
# Use TCP for traceroute (bypasses ICMP blocks)
sudo tcptraceroute example.com 443
# Use UDP (default on Linux)
traceroute -U example.com
# Use ICMP (default on macOS)
traceroute -I example.comDifferent traceroute implementations use different protocols. On macOS, traceroute uses ICMP. On Linux, it uses UDP by default. TCP traceroute (tcptraceroute) is useful when ICMP and UDP are blocked by firewalls.
Traceroute shows the path packets take, but reverse paths may differ (asymmetric routing). Load balancers may show different IPs on each hop. Firewalls may block ICMP Time Exceeded, causing hops to show as asterisks.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.