DTLS vs TLS Transport Workbench

Compare how TLS relies on TCP while DTLS adds datagram reliability, replay, and address-validation tools over UDP

animation

networking

security

tls

dtls

udp

Interactive side-by-side animation for learning the practical differences between TLS over TCP and DTLS over UDP, including packet loss, reordering, anti-replay sequence numbers, handshake retransmission, and DTLS cookie validation.

Animation TLS DTLS Transport Security

DTLS vs TLS Transport Workbench

TLS and DTLS aim for authenticated, confidential, tamper-detecting records. The difference is the transport contract: TLS is normally placed on TCP's ordered byte stream, while DTLS runs on UDP and must make loss, reordering, replay, fragmentation, and spoofed-address checks visible inside the security protocol.

Step 1/4Comparison point

Transport contractCurrent difference

TCP handles orderingRecovery owner

record sequenceDTLS field to watch

Scenarios

Controls

Version focus DTLS 1.3

Network condition normal path

Ready to compare

What To Watch

Track which layer owns the hard part. In TLS over TCP, the transport hides loss and reordering from TLS. In DTLS over UDP, the security layer exposes its own sequence, epoch, timer, and cookie logic.

TransportTCP offers a reliable byte stream. UDP offers independent datagrams.

RecordsTLS records ride inside TCP. DTLS records carry epoch and sequence numbers.

HandshakeTLS waits on TCP. DTLS retransmits handshake flights or uses ACKs.

Address CheckDTLS can use a cookie to avoid server state for spoofed sources.

TLS And DTLS Side By Side

Same security goal, different transport

TLS over TCPTCP has already created an ordered byte stream before TLS records flow.

DTLS over UDPDTLS preserves TLS security goals but each record travels as a datagram.

Current State

TCP byte streamTransport contract

ordered deliveryOrdering model

no TLS timerHandshake recovery

DTLS sequenceReplay marker

Learning Diagnosis

Comparison Transcript

Quick Reference

TLSProtects records after TCP provides reliable, ordered delivery. TLS does not repair missing IP packets itself.

DTLSAdapts TLS security to datagrams by adding replay numbers, epochs, handshake message sequencing, fragmentation, and timers.

IoT MeaningCoAP and other UDP-based IoT protocols can keep UDP behavior while still using transport security.

How To Read The Animation

Blue arrows show TLS records or TCP-protected delivery. If a segment is lost, TCP recovers below TLS.
Green arrows show DTLS datagrams. Orange means a DTLS-level retransmission or ACK-driven recovery is active.
Red dashed paths mark dropped or spoofed traffic. Purple dashed paths mark out-of-order datagrams that DTLS must still interpret safely.
The state chips below the scene name the layer that owns the current problem.

Technical Accuracy Notes

TLS is not inherently tied to TCP in theory, but the common Internet profile uses TLS over a reliable stream. QUIC uses TLS 1.3 differently and is outside this comparison.
DTLS 1.2 uses HelloVerifyRequest for stateless cookie checking. DTLS 1.3 uses the TLS 1.3 HelloRetryRequest cookie extension when a stateless cookie is needed.
DTLS record epoch and sequence number protect records against replay and reordering; handshake message sequence and fragment fields help reconstruct handshake messages.
DTLS retransmission is for handshake reliability. Application data over UDP is still allowed to be lost unless the application adds its own reliability.

Source Links