What is UDP; how does it differ from TCP?

Short answer

UDP (User Datagram Protocol, RFC 768) is the transport protocol that sends individual datagrams without establishing a connection; it gives no guarantee of delivery, order or retransmission, but in return it has low latency because it does not wait for a handshake. Services such as DNS, Syslog, NTP, RADIUS and voice/video use UDP; TCP, by contrast, establishes a connection, compensates for loss with retransmission and preserves the order. In TR7, UDP services are balanced in the Network vService by selecting UDP - L4 as the Protocol; the L7 TCP vService does not carry UDP, and the HTTP vService listens on UDP only for HTTP/3 (QUIC). In the health check, the UDP type sends data to the server and tests whether a response can be received; in Firewall rules, UDP or UDP-Lite is selected as the Protocol, and for UDP a Destination Port is entered.

Where It Is Used in TR7

Where	Field / label	What for
Network vService form	Protocol = UDP - L4	Balancing UDP services such as DNS, NTP and Syslog (UDP Services)
HTTP vService → frontend row → Protocol	Options with the HTTP/3 badge	Listening for QUIC on UDP on the same IP:port alongside TCP (What are HTTP/3 and QUIC?)
Load Balancer → Profiles → Health Checks	Check Type = UDP (with UDP scenario steps), DNS	Checking whether the UDP service responds
Network → Firewall → Add	Protocol = UDP or UDP-Lite; for UDP, Destination Port	Applying the rule to UDP traffic
The L4 DDoS Management screen of the route table	The UDP band (UDP Flood, UDP Signatures)	Rules against UDP floods and known UDP attack signatures

Comparison

	TCP	UDP
Connection	Established with the three-way handshake	Not established
Delivery and order	Guaranteed (retransmission, sequence number)	Not guaranteed
Latency	Higher because of the handshake and acknowledgments	Low
Typical services	HTTP/1.1, HTTP/2, SSH, SMTP, LDAP, database	DNS, Syslog, NTP, RADIUS, HTTP/3 (QUIC)
Balancing in TR7	HTTP, L7 TCP, Network (TCP - L4)	Network (UDP - L4); in the HTTP vService, only HTTP/3
TR7 health check type suited to the service	TCP, TCPS, HTTP and the other TCP-based types	UDP; DNS for DNS services

Common Misconceptions

• "UDP services are balanced with the L7 TCP vService." L7 TCP carries only TCP; UDP services are balanced in the Network vService with UDP - L4 (Can I load balance UDP traffic (DNS, Syslog, NTP)?).
• "UDP is not used because it is unreliable." It is preferred for services that tolerate loss at the application level and want speed; most DNS queries go over UDP.
• "A health check cannot be performed on a UDP service." In the UDP-type health check, the data to be sent and the expected response are defined with UDP scenario steps (How do I health check UDP services other than DNS (UDP scenario, Hex/Base64/text)?).

How it is done in the documentation

• Network vService · UDP Services
• Health Checks · UDP
• Firewall · Protocol

Related questions

• Can I load balance UDP traffic (DNS, Syslog, NTP)?
• How do I health check UDP services other than DNS (UDP scenario, Hex/Base64/text)?
• What is TCP; where is it used in TR7?
• What is a UDP Flood; why does TR7 apply a separate flood limit to DNS requests?