UDP Protocol Number- Complete Reference Guide

What Is UDP and Why the Protocol Number Matters

UDP stands for User Datagram Protocol. It's one of the core protocols of the internet protocol suite, sitting alongside TCP at the transport layer. Unlike TCP, UDP doesn't establish connections before sending data. It just fires packets and hopes for the best.

The UDP protocol number is 17. This number identifies UDP in the IP header when routers and firewalls inspect packet headers. If you're working with network configuration, security rules, or any kind of traffic analysis, you need to know this number cold.

UDP Protocol Number: The Basics

When you see protocol number 17 in a firewall rule or packet capture, that means UDP. Here's the quick reference:

• Protocol Number 17 = UDP (User Datagram Protocol)
• Protocol Number 6 = TCP
• Protocol Number 1 = ICMP

Protocol numbers live in the Protocol field of the IPv4 header (field number 9). In IPv6, it's the Next Header field. Same concept, different name.

How UDP Actually Works

UDP is brutally simple. Here's what happens:

1. Your application sends a datagram to the UDP layer
2. UDP adds its own header (source port, destination port, length, checksum)
3. The packet moves to IP, which adds its own header
4. The packet travels across the network
5. The receiver's UDP layer strips the UDP header and delivers data to the app

No handshake. No acknowledgment. No retransmission. If packets get lost, corrupted, or arrive out of order, UDP does nothing about it. That's not a bug—it's the feature. For real-time applications, waiting for retransmission would ruin the experience anyway.

UDP Header Structure

The UDP header is only 8 bytes. Compare that to TCP's minimum 20 bytes, and you see why UDP is faster:

• Source Port (2 bytes) — Which port on the sender's machine
• Destination Port (2 bytes) — Which port on the receiver's machine
• Length (2 bytes) — Total size of UDP header + data
• Checksum (2 bytes) — Error detection for the header and data

That's it. Eight bytes of overhead versus TCP's minimum twenty. For high-volume, latency-sensitive traffic, that difference adds up fast.

UDP vs TCP: The Real Differences

Most people know TCP is "reliable" and UDP is "fast," but the tradeoffs run deeper than that:

TCP hands you reliability on a silver platter. UDP gives you raw speed and lets you build your own reliability layer on top if you need it. Many protocols do exactly that—QUIC (used by HTTP/3) runs over UDP and implements its own connection handling and loss recovery.

Common UDP Ports You Need to Know

Protocol numbers tell you the transport layer protocol. Port numbers tell you which application is listening. Here are the UDP ports you'll encounter most often:

Port 53 (DNS) is the big one. When you type a URL, your computer sends a UDP packet to your configured DNS resolver on port 53. TCP DNS exists, but it's reserved for responses that don't fit in a single UDP packet.

When to Use UDP

UDP makes sense when:

• Speed matters more than perfect delivery — Video streaming, online gaming, VoIP
• You can tolerate some packet loss — One dropped video frame is better than a frozen screen waiting for retransmission
• You need broadcast or multicast — TCP can't do this; UDP can
• You're building your own reliability layer — QUIC, RTSP, custom protocols
• Simplicity is required — DNS queries, simple status checks

UDP is the wrong choice when you need guaranteed delivery of every single byte. File transfers, database replication, web traffic (until HTTP/3)—these all need TCP or a UDP-based protocol you've specifically designed for reliability.

Getting Started: Capturing UDP Traffic

Want to see UDP in action? Here's how to capture it:

Using Wireshark

Open Wireshark and apply this filter:

udp.port == 53

This shows you all DNS traffic. Change the port number to whatever service you're debugging.

Using tcpdump (Linux/macOS)

Capture UDP packets on port 53:

sudo tcpdump -i any udp port 53

Capture all UDP traffic:

sudo tcpdump -i any udp

Configuring Firewalls for UDP (Protocol 17)

Allow incoming UDP on port 53 (example with iptables):

iptables -A INPUT -p udp --dport 53 -j ACCEPT

Block all UDP except specific ports:

iptables -A INPUT -p udp -j DROP
iptables -I INPUT -p udp --dport 53 -j ACCEPT

Remember: blocking UDP doesn't just block one service. Many services run exclusively over UDP. If you block all UDP, you lose DNS resolution, NTP, and more.

Security Considerations with UDP

UDP's stateless nature makes it a popular vector for attacks. Here's what to watch for:

• UDP flood attacks — Attackers send massive volumes of UDP packets, overwhelming your bandwidth
• DNS amplification — Open DNS resolvers can be tricked into sending huge responses to a victim's IP
• Spoofing — Without connection handshakes, UDP source addresses are trivially falsified
• Port scanning — Attackers probe UDP ports to find open services

Protect your UDP services by rate-limiting, using source validation where possible, and not exposing unnecessary UDP ports to the internet.

Quick Reference: Protocol Numbers

Protocol number 17 is UDP. Protocol number 6 is TCP. Memorize those two and you've covered 95% of real-world traffic.

The Bottom Line

UDP protocol number is 17. It's connectionless, fast, and has minimal overhead. It doesn't guarantee delivery or order, but for real-time applications, that's the right trade-off. DNS, streaming, gaming, VoIP—all run over UDP because waiting for retransmission would make them unusable.

Know your protocol numbers. Know your ports. Know when to use UDP versus TCP. That's the foundation of network troubleshooting and security work.