Although UDP is actually a stateless protocol, even UDP-based protocols can be said to be short-term connections, as most of them are request-response protocols: Here, a client sends its request to the server’s well-known port (e.g. 53 for DNS), and this sends back its response to the source port selected by the client:
| Client port | Connection | Server port |
|---|---|---|
| 12345 | Request | 53 |
| 12345 | Response | 53 |
However, for a server to send larger amounts of data, for example using TFTP where it does not need to differentiate between requests and acknowledgments on the well-known port, it first sends the response packet to the source port of the sender. In doing so, it sets an arbitrary free port as its own source port for exchanging data with the client:
| Client port | Connection | Server port |
|---|---|---|
| 12345 | Request | 69 |
| 12345 | Response | 54321 |
| 12345 | AckData | 54321 |
| 12345 | Data/Ack | 54321 |
With data transmission ongoing via the ports 12345 and 54321, the server can accept further requests on its well-known port (69). If the device pursues a "deny-all strategy", the client's first request creates an entry in the connection list that only allows the server's data packets on port 69. The answer from the server would simply be dropped. To prevent this, the entry created in the connection list initially has no value for the connection’s destination port, and this is only set when the first response packet arrives. This caters for both possible cases of a UDP connection.
