UDP

The User Datagram Protocol adds two things to IP: ports, so several programs can share an address, and a checksum. Nothing else: no connection, no acknowledgement, no ordering, no retransmission. A UDP datagram arrives whole or not at all. Protocols that want speed, or do their own reliability, build on it: DNS, DHCP, NTP, video calls, games, WireGuard, and QUIC (HTTP/3).

The header

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            Length             |           Checksum            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                             Data                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Offset	Size	Field	Meaning
0	2	Source Port	The sender's port, random for a client. Where the answer goes.
2	2	Destination Port	The service: 53 DNS, 67/68 DHCP, 123 NTP, 443 QUIC, 5353 mDNS...
4	2	Length	Header + data, in bytes (8 minimum).
6	2	Checksum	Pseudo-header + header + data. Optional over IPv4 (0 = none), mandatory over IPv6.

Example: a DNS query

0020        93 0f 00 35 00 3c 84 51 9e 28 01 20 00 01 ...

Bytes	Field	Value
93 0f	Source Port	37647, chosen at random by dig
00 35	Destination Port	53, DNS
00 3c	Length	60: 8 of header + 52 of DNS
84 51	Checksum	0x8451, the pseudo-header's partial sum: checksum offload, see TCP

The answer comes back with the ports swapped (00 35 93 0f): that's how the client's system knows which program it's for.

NetOtter's i shows the header, what the data is (here a DNS query, read by NetOtter while capturing), then the data:

  Protocol     UDP  (17)
  TTL          64
  UDP header   8 bytes
    Ports      37647 -> 53
    Length     60
    Checksum   0x8451
  DNS          query #40488, question example.com (A)
  Data         looks like DNS
  Payload      60 bytes
  0000  93 0f 00 35 00 3c 84 51  9e 28 01 20 00 01 00 00  |...5.<.Q.(. ....|
  0010  00 00 00 01 07 65 78 61  6d 70 6c 65 03 63 6f 6d  |.....example.com|

The DNS page decodes the rest.

No connection, but "flows"

UDP has no handshake, but firewalls and NAT routers still track (address, port) pairs to let answers back in. A QUIC connection is a long series of UDP datagrams between the same ports; QUIC adds its own connection ids, so a connection can survive a change of address.

In NetOtter

• Parsing: parse_udph() (Parsers) reads the 8-byte header and sets the ports.
• Hostnames: UDP from port 53 goes to the DNS hostname learner, and UDP datagrams of 1200 bytes or more to the QUIC learner (Hostname learning).
• Filters: proto udp, port, portsrc, portdest.

Read more

• RFC 768: UDP (three pages)
• RFC 8085: guidelines for protocols built on UDP