Layer 4: Transport Layer
Reliable End-to-End Communication
The Transport Layer provides reliable data transfer services to the upper layers. It handles error detection, error recovery, flow control, and ensures complete data transfer between host systems.
Layer 4 (Transport) Technologies
The Transport Layer is responsible for reliable end-to-end data delivery between applications. It provides connection management, error recovery, flow control, and data segmentation between processes running on different hosts.
The Critical Role: While Layer 3 routes packets between networks, Layer 4 ensures reliable communication between specific applications using port numbers and connection state management.
Client App
Server App
Transport Protocol Information
🎯 Primary Functions
- Segmentation: Breaking data into smaller, manageable segments
- Error Detection & Recovery: Ensuring data integrity
- Flow Control: Managing data transmission rates
- Connection Management: Establishing and terminating connections
- Multiplexing: Multiple applications using the network simultaneously
🔧 Key Characteristics
- Port Numbers: Identify specific applications (0-65535)
- Sequence Numbers: Track data order and completeness
- Acknowledgements: Confirm successful data receipt
- Window Size: Control flow and prevent buffer overflow
- Checksums: Detect transmission errors
🌐 Major Transport Layer Protocols
🔒 TCP (Transmission Control Protocol)
Connection-oriented, Reliable
What you see in Wireshark: Three-way handshake with SYN, SYN-ACK, ACK flags
Like a phone call - establish connection, talk, hang up properly📡 UDP (User Datagram Protocol)
Connectionless, Fast
What you see in Wireshark: Simple header with source/dest ports, length, and checksum
Like sending a postcard - quick, simple, no delivery guarantee🔄 SCTP (Stream Control Transmission)
Multi-streaming, Reliable
What you see in Wireshark: Chunk-based protocol with multi-homing support
Like TCP but with multiple lanes on the highway🏢 SPX (Sequenced Packet Exchange)
NetWare's reliable protocol
What you see in Wireshark: Similar to TCP but for Novell networks
Legacy protocol mostly replaced by TCP⚖️ TCP vs UDP Comparison
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented (3-way handshake) |
Connectionless (fire and forget) |
| Reliability | Guaranteed delivery Error recovery |
Best effort No error recovery |
| Speed | Slower (overhead for reliability) |
Faster (minimal overhead) |
| Header Size | 20 bytes minimum | 8 bytes fixed |
| Flow Control | Yes (sliding window) | No |
| Use Cases | Web browsing, Email File transfer, Databases |
DNS queries, Video streaming Online gaming, DHCP |
🔍 Real-World Example: Web Page Download (TCP)
Scenario: Your browser downloads a webpage from a server
What happens at the Transport Layer:
- Connection Establishment: Browser initiates TCP 3-way handshake with server
- Data Segmentation: Large webpage is broken into TCP segments
- Reliable Delivery: Each segment is numbered and acknowledged
- Error Handling: Missing segments are automatically retransmitted
- Flow Control: Prevents server from overwhelming browser
- Connection Termination: 4-way handshake to close connection
In Wireshark, you can see the complete TCP conversation with all control flags and sequence numbers.
🎮 Understanding Port Numbers
Port numbers allow multiple applications to use the network simultaneously. Think of them as apartment numbers in a building (IP address).
Well-Known Ports (0-1023)
HTTP
HTTPS
SMTP
DNS
FTP
SSH
Ephemeral Ports
IANA reserves 49152–65535 as the dynamic/private range, but operating systems choose their own: Linux defaults to 32768–60999, Windows to 49152–65535. Ports 1024–49151 in between are the registered range (MySQL 3306, RDP 3389, and so on).
Browser
Email Client
Game Client
Chat App
🐛 Common Transport Layer Issues
- Port Conflicts: Multiple applications trying to use same port
- Firewall Blocking: Ports blocked by security policies
- Connection Timeouts: Network congestion or server overload
- Packet Loss: Network issues causing retransmissions
- Buffer Overflow: Receiving data faster than processing
🔧 Troubleshooting Tools
- Netstat: Show active connections and listening ports
- Wireshark: Analyse packet flow and connection states
- Telnet: Test if specific ports are accessible
- TCPView: Real-time view of TCP and UDP activity
- SS/Netstat: Socket statistics and connection info
🎓 Teaching Analogy: Shipping and Postal Services
Think of the Transport Layer like different shipping services:
🔒 TCP = Certified Mail with Tracking
- Reliable: Sender gets confirmation of delivery
- Ordered: Packages arrive in correct sequence
- Error Recovery: Lost packages are automatically resent
- Slower: Extra processing for reliability guarantees
📡 UDP = Regular Mail
- Fast: Just drop it in the mailbox and go
- Best Effort: Usually gets there, but no guarantees
- No Tracking: You don't know if it arrived
- Efficient: Minimal overhead and processing
The Transport Layer chooses the right "shipping method" based on what the application needs!
📚 Key Learning Points
- Transport Layer provides end-to-end communication between applications
- Port numbers enable multiple applications to share the network
- TCP is reliable but slower - use for important data
- UDP is fast but unreliable - use for real-time applications
- Transport Layer handles error recovery, flow control, and connection management
- Understanding TCP's 3-way handshake is crucial for network troubleshooting
Check your understanding — Layer 4
Five questions on Layer 4 — TCP, UDP, ports and reliability.
-
What is the PDU at the Transport Layer?
TCP calls its unit a segment; UDP calls its unit a datagram. Both get wrapped in an IP packet by Layer 3.
-
In what order does the TCP three-way handshake happen?
The client sends SYN, the server answers SYN/ACK, and the client confirms with ACK. This synchronises the initial sequence numbers in both directions before any data flows.
-
Which transport protocol is connectionless?
UDP just fires a datagram off with no handshake, no acknowledgements and no ordering. That is why DNS queries, DHCP, VoIP media and most game traffic use it — a lost packet matters less than a delayed one.
-
What is the minimum size of a TCP header?
20 bytes without options, which is why the usual MSS on a 1500-byte Ethernet MTU is 1460 (1500 − 20 IP − 20 TCP). A UDP header, by contrast, is a fixed 8 bytes.
-
HTTP/3 runs on top of which transport?
HTTP/3 uses QUIC, a modern transport built on UDP with TLS 1.3 and stream multiplexing baked in. It avoids the head-of-line blocking that affects HTTP/2 over TCP.
Layer 4 (Transport) — frequently asked questions
What is the Transport Layer?
The Transport Layer is Layer 4. It delivers data between specific applications rather than merely between hosts, using port numbers to tell them apart. Depending on the protocol chosen it may also segment large amounts of data, acknowledge and retransmit what is lost, put segments back in order, and control the sending rate.
TCP or UDP — which should I use?
Use TCP when every byte must arrive, in order: web pages, email, file transfer, databases. Use UDP when late data is worthless and speed matters more than completeness: live voice and video, DNS lookups, DHCP, game state updates. Modern protocols increasingly build their own reliability on UDP — QUIC is the clearest example.
What is a port number?
A port is a 16-bit number (0–65535) that identifies which application on a host a segment belongs to. The IP address gets the data to the right machine; the port gets it to the right process. Well-known ports run 0–1023 (HTTP 80, HTTPS 443, SSH 22), registered ports 1024–49151, and dynamic ports 49152–65535.
Why does closing a TCP connection take four steps?
TCP connections are full-duplex, so each direction has to be closed independently. Each side sends its own FIN and receives an ACK for it — FIN, ACK, FIN, ACK — which lets one side finish sending while the other is still transmitting.