4

We are working on a game with millions of clients communicating with our servers. These games are for the most part turn-based. I am aware that UDP offers some performance advantages over TCP, but I'm wondering if one protocol enjoys a security advantage over the other? I've read some sites indicating that TCP will generally be safer, but I've seen a significant number of attacks that exploit weaknesses in TCP.

Our code is pretty tolerant of unreliable connections and lost/out-of-order data, which is why I thought of UDP. Thank you!

1
  • 4
    Neither of these protocols is designed with security in mind... Commented Mar 27, 2013 at 19:10

2 Answers 2

7

The big security problem with UDP is that you are susceptible to spoofing and DOS attacks. It's not possible to spoof an address across the internet using TCP since the handshake will never complete. OTOH with UDP there is no implicit handshake - any session maintenance must be done by your code (processing overhead).

I am aware that UDP offers some performance advantages over TCP

Only across a LAN - part of the reason is the decreased latency of not having to carry out a handshake - but the big difference is that it bypasses congestion control mechanisms. That's not an issue for data across a LAN where the packet loss will be very low - but if you want to send data across the internet you're going to have to implement bandwidth throttling, error recovery and congestion control in your application (more processing overhead). While you can handle some types of packet loss via forward error control, this won't help with an overloaded router. All that stuff which slows down UDP is there for a reason.

If your dataflows are not more than, say 2 MSS in any direction followed by an acknowledgement from the remote end, then go for it - but if you want to move a lot of data quickly use TCP (or a station wagon).

6
  • Our game isn't streaming audio or video, it's just conveying brief packets with current game state - would this avoid the congestion problem? Commented Mar 27, 2013 at 21:20
  • If they really are brief then congestion shouldn't shouldn't be too much of an issue - and using FEC would reduce the impact - however there's not too much data on how reliable UDP is across the internet hence I'd recommend carrying out some field trials or sticking with TCP.
    – symcbean
    Commented Mar 27, 2013 at 21:58
  • 1
    @symcbean UDP does not create a reliable form of communication and therefore has performance advantages over TCP which does guarantee that each and every packet is received. Commented Aug 25, 2014 at 20:53
  • @symcbean Also, it is possible to hijack TCP sessions, most typically on LAN's, but it is theoretically possible to do remote TCP session hijacks using timer attacks. Commented Aug 25, 2014 at 20:54
  • @person27: perhaps you would like to justify your claims and put forward a counter proposal instead of criticizing other people.
    – symcbean
    Commented Jun 23, 2019 at 20:38
5

This is a good resource to compare UDP and TCP : http://www.skullbox.net/tcpudp.php.

Traditionally,most real-time applications use UDP eg:VOIP.I am not an expert on Security, but I guess both of them are equally secure/unsecure.It depends on usage of Security protocols like TLS etc.

TCP just has mechanisms to guarantee delivery of packets.

1
  • Per my understanding, TCP also has a handshake model for connecting to a port to listen to traffic where auth is done before the encryption is established. So it's more than guaranteeing delivery of packets.
    – kettlecrab
    Commented Jun 22, 2019 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.