• Glossary
  • What is TCP (Transmission Control Protocol)?

Security glossary

What is TCP (Transmission Control Protocol)?

Transmission Control Protocol (TCP) is a transport layer network protocol that provides reliable, ordered, error-checked delivery of a byte stream between applications on IP hosts. It sets up a connection with a three-way handshake, numbers every byte, and retransmits lost data, as defined in RFC 9293.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

Transmission Control Protocol (TCP) is a transport layer network protocol defined in RFC 9293 that provides reliable, ordered, error-checked delivery of byte streams between applications on IP hosts through a three-way handshake, byte numbering, and automatic retransmission of lost data. TCP forms the foundation of enterprise application traffic including web, email, and database sessions, as well as critical network services like DNS zone transfers and large DNS responses that UDP cannot accommodate. Organizations must properly manage TCP connections and firewall rules to avoid intermittent failures, such as DNS resolution issues when only UDP port 53 is permitted, and must understand that TCP connection state exhaustion forms the basis of SYN flood attacks that require defenses like SYN cookies and rate limiting.

  • TCP establishes connections through a three-way handshake (SYN, SYN-ACK, ACK) and tracks every byte with sequence numbers and checksums, enabling the receiver to detect corruption and request retransmission of missing segments.
  • DNS requires TCP port 53 support per RFC 7766 for zone transfers, large responses, and truncated reply retries, meaning firewalls that permit only UDP port 53 will cause intermittent resolution failures.
  • Every TCP connection consumes state on endpoints and network devices, making connection exhaustion the attack vector for SYN floods, which require defenses such as SYN cookies, connection limits, and rate limiting to mitigate.

TCP at a glance

AttributeValue
Full nameTransmission control protocol
CategoryNetwork protocol
Defined inRFC 9293, which replaced RFC 793
Protocol and portIP protocol number 6; ports are identified by 16-bit numbers, for example 53 for DNS
OSI layerLayer 4 (transport)
Primary useReliable, ordered delivery of data between applications
Related termsUDP, IP, DNS, DHCP, port, three-way handshake

How TCP works

TCP gives applications a reliable byte stream on top of IP, which delivers packets without guaranteeing arrival or order. It does this by establishing a connection and tracking every byte sent.

  1. Open the connection: The client sends a SYN segment with an initial sequence number. The server replies with SYN-ACK, and the client answers with ACK. This is the three-way handshake.
  2. Transfer data: Each side divides data into segments and numbers them by byte position. The receiver returns acknowledgments that confirm the next byte it expects.
  3. Control flow and congestion: The receiver advertises a window that limits how much unacknowledged data the sender may have in flight. The sender also slows down when it detects loss that suggests network congestion.
  4. Recover from loss: If an acknowledgment does not arrive in time, or repeated acknowledgments signal a gap, the sender retransmits the missing data. The receiver reorders segments and discards duplicates before passing data to the application.
  5. Close the connection: Each side sends a FIN segment when it has finished sending, and the other side acknowledges it. A RST segment aborts a connection immediately.

A checksum in each segment lets the receiver detect corruption. TCP carries a stream of bytes with no message boundaries, so applications must frame their own messages. Because of the handshake and acknowledgments, TCP adds latency and per-connection state compared with UDP.

Why TCP matters in enterprise networks

TCP carries most enterprise application traffic, including web, email and database sessions. It also matters for core network services. DNS uses UDP port 53 for most queries but must also support TCP port 53, as RFC 7766 requires, for large responses, zone transfers and when a response is truncated. DHCP does not use TCP for normal address assignment; it runs over UDP ports 67 and 68.

Every TCP connection consumes state on both endpoints and on any firewall or load balancer in the path. Exhausting that state is the basis of SYN flood attacks, in which an attacker sends many SYN segments without completing the handshake. Defenses such as SYN cookies, connection limits and rate limiting reduce the risk.

Managing TCP badly causes failures that are hard to trace. A firewall that permits only UDP port 53 will break DNS responses that need TCP, producing intermittent resolution failures for large records. Retransmissions, resets and long handshake times are useful observability signals, because they point to packet loss, overloaded servers or blocked paths before users report an outage.

TCP vs UDP

TCP provides connection-oriented, reliable, ordered delivery, while UDP sends independent datagrams with no connection setup, retransmission or ordering. What is UDP?

AttributeTCPUDP
Connection setupThree-way handshake before data flowsNone; datagrams are sent immediately
Delivery guaranteeAcknowledged and retransmitted if lostNot guaranteed
OrderingBytes delivered in orderNo ordering
Congestion and flow controlBuilt inLeft to the application
Typical overheadHigher, because of state and acknowledgmentsLower

Common misconceptions about TCP

Many people assume DNS never uses TCP. RFC 7766 requires DNS implementations to support TCP, and it is used for truncated responses, zone transfers and large answers. A firewall that allows only UDP port 53 can cause intermittent failures for large responses.

TCP/IP is a family of protocols, not one protocol. IP handles addressing and routing of packets, while TCP adds reliability on top of IP. Other transports, such as UDP, also run over IP.

DHCP address assignment runs over UDP ports 67 and 68, not TCP. Opening a TCP port for DHCP clients does not fix lease failures; check UDP reachability and relay configuration instead.

TCP guarantees delivery, not low latency. Packet loss triggers retransmission and congestion control, which can reduce throughput and add delay, so a reliable session over a lossy link can still feel slow.

A successful TCP handshake only shows that something is listening and the path allows the connection. The application behind the port can still be failing, so a handshake test does not prove the service responds correctly.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

TCP FAQ

Related terms

Article

User Datagram Protocol (UDP)

An alternative protocol to TCP used primarily for establishing low-latency and loss-tolerating connections between applications on the internet.

Learn more
Article

DNS – Domain Name System

A hierarchical naming system that enables communication across devices in a network.

Learn more
Article

DHCP (Dynamic Host Configuration Protocol)

The standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

OSI model

A conceptual model that characterizes and standardizes the communication functions of a telecommunication or computing system.

Learn more
Article

Internet Protocol Address (IP Address)

A numerical label assigned to each device connected to a network that uses IP for communication.

Learn more
Article

Transport layer security (TLS)

A cryptographic protocol to provide communications security over a computer network.

Learn more
Article

ACL (Access Control List)

Limits which entities are allowed to perform certain functions against a DNS server, such as sending queries or performing dynamic updates.

Learn more
Article

DNS zone

A distinct, contiguous portion of the domain name space for which administrative responsibility has been delegated to a single manager.

Learn more
Browse the full glossary