How Do Sockets Work? A Deep Dive into TCP/UDP Connection Lifecycle

Protocol Stack Overview

The operating system’s networking stack is layered as follows: the application layer uses the socket library, which in turn interacts with the kernel’s protocol stack. The upper part of the stack implements TCP and UDP for transport, the lower part implements IP for routing, and the network‑card driver finally transmits the resulting frames on the physical medium.

Socket Concept and Control Information

A socket is not a physical object; it is a data structure stored in kernel memory that holds the remote IP address, remote port, local port, and the current state of the connection. The netstat utility can display these fields for each open socket.

Proto : protocol type (e.g., tcp or udp)

Local Address : host IP and port

Foreign Address : peer IP and port

State : connection state such as ESTABLISHED, LISTEN, CLOSE_WAIT, etc.

Establishing a TCP Connection

After a socket is created, the application calls connect(). The kernel performs the TCP three‑way handshake:

SYN : client sends a TCP segment with the SYN flag set to 1 and an initial sequence number.

SYN‑ACK : server replies with SYN=1 and ACK=1, acknowledging the client’s sequence and providing its own initial sequence number.

ACK : client sends a final segment with ACK=1, confirming the server’s sequence. At this point the socket state becomes ESTABLISHED and data can be exchanged.

Data Transmission

The application triggers transmission by calling write() (or send()) with a buffer and length. The kernel may place the data in a send buffer instead of transmitting immediately, to avoid sending many small packets.

Network Packet Size (MTU and MSS)

MTU (Maximum Transmission Unit) is the largest Ethernet frame size, typically 1500 bytes, including all headers. MSS (Maximum Segment Size) is the largest payload that can be carried in a TCP segment after subtracting the TCP and IP headers.

Transmission Timer

If the application sends data slowly, waiting for the send buffer to reach MSS would cause excessive latency. The TCP stack therefore starts a timer; when the timer expires, the buffered data is transmitted even if the MSS threshold has not been reached.

ACK Mechanism

Each transmitted segment carries a sequence number. The receiver acknowledges receipt by sending an ACK containing the next expected sequence number. This allows the sender to detect lost segments and retransmit them.

Sliding Window Flow Control

Instead of waiting for an ACK after each segment, TCP uses a sliding window. The receiver advertises a window size indicating how many bytes it can accept; the sender may transmit multiple segments up to that limit without waiting for individual ACKs, improving throughput. If the receiver’s buffer fills, it reduces the advertised window, causing the sender to pause.

Graceful Connection Termination

When the application calls close(), the kernel sends a TCP segment with the FIN flag set to 1. The peer acknowledges the FIN with an ACK, then also sends its own FIN, which is acknowledged in turn. After both FIN‑ACK exchanges the connection enters the CLOSED state.

UDP Data Transfer

UDP is connectionless: no handshake, no ACK, and no flow‑control window. The sender constructs an IP packet containing a UDP header (source/destination IP and ports) and the payload. The receiver extracts the ports from the UDP header, matches them to the appropriate socket, and delivers the payload directly to the application.