Protocol Comparisons

TCP guarantees delivery, ordering, and error correction at the cost of latency. UDP sends datagrams with no guarantees, no handshake, and minimal overhead. Use TCP when data integrity matters (web, email, databases). Use UDP when speed matters more than reliability (DNS, video, gaming, VoIP).

TCP is a kernel-managed transport with a 50-year design. QUIC is a user-space transport over UDP that redesigns TCP's reliability, congestion control, and TLS integration from scratch – solving TCP's head-of-line blocking, slow connection setup, and inability to migrate across IPs. QUIC is the transport behind HTTP/3.

HTTP is the application protocol for web communication – it defines methods, headers, status codes, and message format. HTTPS is HTTP over TLS – the same protocol wrapped in an encrypted tunnel. In 2026, HTTPS is the only acceptable choice for any real deployment. HTTP exists for localhost development and the initial redirect to HTTPS.

HTTP/1.1 is a text-based protocol with persistent connections. Browsers open up to 6 parallel connections per origin to work around sequential request-response ordering. HTTP/2 is a binary protocol that multiplexes all requests over a single TCP connection and compresses headers with HPACK (85–90% reduction). For workloads dominated by many small assets, HTTP/2 significantly reduces round-trip overhead. The semantics – methods, headers, status codes – are identical. Only the wire format changed.

HTTP/2 (RFC 9113) multiplexes requests over a single TLS-encrypted TCP connection, eliminating HTTP/1.1 head-of-line blocking at the HTTP layer. HTTP/3 (RFC 9114) goes further by replacing TCP with QUIC (UDP-based), eliminating TCP-level head-of-line blocking entirely and adding 0-RTT connection resumption. HTTP/3 is now the default on most CDNs. For most deployments behind a proxy or CDN, enabling HTTP/3 is a configuration change that improves performance with zero application changes.

SSL (Secure Sockets Layer) is the deprecated predecessor of TLS (Transport Layer Security). All SSL versions (2.0, 3.0) have critical vulnerabilities and are disabled in modern software. TLS 1.2 and 1.3 are the current standards. When people say 'SSL certificate' they mean a TLS certificate – the term persists from habit.

TLS 1.3 (RFC 8446) is strictly better than TLS 1.2 in every meaningful dimension: 1 RTT handshake vs 2 RTT, mandatory forward secrecy via ephemeral key exchange, 5 cipher suites (all AEAD) vs a combinatorial set in TLS 1.2 that includes RC4, 3DES, NULL, and export-grade entries, encrypted certificates, and no renegotiation. The only reason to retain TLS 1.2 is legacy client compatibility.

IPsec is the enterprise VPN standard with decades of deployment, complex configuration, and IKEv2 key exchange. WireGuard is a modern VPN with ~4000 lines of code, fixed cryptography (Curve25519, ChaCha20), and kernel-level performance. WireGuard is simpler and faster; IPsec has broader interoperability and richer policy options.

Both DoH and DoT encrypt DNS queries to prevent eavesdropping and tampering. DoH runs DNS over HTTPS on port 443 – indistinguishable from web traffic, harder to block, browser-friendly. DoT runs DNS over TLS on a dedicated port 853 – identifiable as DNS traffic, easier for network admins to monitor and filter. Neither prevents the resolver from seeing your queries.

IPv4 uses 32-bit addresses (4.3 billion total) – exhausted in 2011. IPv6 uses 128-bit addresses (340 undecillion) – designed to last indefinitely. Beyond address space, IPv6 removes NAT as a requirement, mandates IPsec support, simplifies headers for router efficiency, and has built-in stateless address autoconfiguration (SLAAC). IPv6 adoption passed 40% globally in 2024.

REST uses HTTP/1.1 or HTTP/2 with JSON over text – human-readable, universally supported, and browser-friendly. gRPC uses HTTP/2 with Protocol Buffers (binary) – strongly typed, 5–10x smaller payloads, and bidirectional streaming. REST is the right default for public APIs and browser clients. gRPC is the right choice for internal microservice communication where performance and schema enforcement matter.

JSON is human-readable text – easy to debug, universally supported, and self-describing. Protocol Buffers (Protobuf) is a binary format requiring a .proto schema – field numbers replace key names in every message, producing smaller payloads and faster parsing for typical structured data. The performance advantage is workload-dependent: measurable at high throughput, negligible for small payloads or low-RPS services. JSON wins on tooling and browser compatibility. Protobuf wins on throughput and compile-time type safety. gRPC uses Protobuf; REST APIs typically use JSON.

WebSocket is a full-duplex binary protocol – both client and server can send messages at any time. SSE (Server-Sent Events) is a half-duplex HTTP protocol – only the server pushes data; client-to-server communication uses separate HTTP requests. SSE is simpler, works over plain HTTP/2, and automatically reconnects. WebSocket is needed for true bidirectional, low-latency communication.

Polling has the client ask the server repeatedly: 'Is there anything new?' Webhooks have the server push updates to the client when they happen. Polling is simple to implement and works everywhere. Webhooks are more efficient for infrequent events but require the client to have a publicly accessible HTTPS endpoint. The right choice depends on event frequency, infrastructure, and latency requirements.

OAuth 2.0 is an authorization framework – a protocol defining how to delegate access between systems. JWT (JSON Web Token) is a token format – a compact, self-contained way to encode claims. They are not alternatives: OAuth 2.0 commonly uses JWT as its token format. Comparing them is like comparing a shipping protocol to the box format used for shipping.

Synchronous APIs respond immediately – the client blocks until the result arrives. Asynchronous APIs accept a request, return immediately with a job ID or 202 Accepted, then deliver the result later via polling or webhook. Synchronous is simpler to implement and consume. Asynchronous is necessary when operations take longer than a few seconds or when decoupling producers from consumers.

MQTT is a lightweight publish-subscribe protocol designed for constrained IoT devices with minimal bandwidth. AMQP is a feature-rich message broker protocol with guaranteed delivery, routing, and transactions. Use MQTT for IoT telemetry; use AMQP for enterprise messaging where routing flexibility and reliability matter.

SMTP sends email – it's the outbound delivery protocol used from client to server and server to server. IMAP retrieves email – it's the inbound access protocol that keeps messages on the server and synchronizes state across devices. They solve opposite sides of the email problem and are always used together, never interchangeably.

SSH encrypts the entire session including authentication. Telnet transmits everything in cleartext – passwords, commands, and output are visible to any network observer. SSH replaced Telnet for all remote administration. Telnet remains only for initial console setup of network devices with no SSH firmware.

SFTP runs over SSH (port 22) using a single encrypted connection for commands and data. FTPS wraps FTP in TLS but still uses separate control (990) and data (989) channels, causing NAT/firewall issues. SFTP is simpler to firewall, deploy, and troubleshoot. FTPS exists mainly for legacy FTP client compatibility.