User Datagram Protocol (UDP)

User Datagram Protocol is the connectionless protocol at the transport layer of the internet protocol suite, specified in RFC 768 in 1980. A sender addresses a datagram to a port and sends it. There is no handshake, acknowledgement, retransmission or ordering, and the header is eight bytes: two ports, a length and a checksum. The application supplies any reliability it needs. That suits traffic where speed matters more than an occasional lost packet, such as live voice and video, and short request and reply exchanges such as DNS queries, DHCP, SNMP and NTP.

The missing handshake has a security cost. With TCP, a forged source address cannot normally complete the connection, but a UDP request is answered in one step, so an attacker can put the victim’s address on a request and have a server send its reply there. When the reply is much larger than the request, this becomes an amplification attack, and DNS and NTP servers have been abused this way. A stateful firewall can only approximate a UDP session with a timeout, which makes precise filtering harder.

Exam relevance: a scenario is likely to ask which transport suits streaming or voice, or why reflection attacks favour UDP. Candidates are expected to link UDP with low overhead and no delivery guarantee, and TCP with reliability and connection state.