when I asked people to explain how UDP works I got a lot of answers to the effect of "it's spray and pray"

but I'm having trouble thinking of examples of UDP-based protocols that actually work in a "spray and pray" way —

* DNS is "send 1 packet, retry if you don't get a reply”
* QUIC is a sophisticated system for streaming data over UDP
* I'd guess that video protocols correct for packet loss
* maybe statsd is a "spray and pray” system?

(please do not reply to this explaining how UDP works)

@b0rk DNS NOTIFY? You send the packet but never expect any form of ack.

There are may be other types of best-effort notification working the same way.

@bortzmeyer @b0rk
There is a response defined in RFC1996 4.7:

"It will also send a NOTIFY response back to the NOTIFY request's source, with the following characteristics..."

https://datatracker.ietf.org/doc/html/rfc1996

RFC 1996: A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY)

This memo describes the NOTIFY opcode for DNS, by which a master server advises a set of slave servers that the master's data has been changed and that a query should be initiated to discover the new data. [STANDARDS-TRACK]

IETF Datatracker
@bortzmeyer @b0rk This seems like a good example of an optimization where successful delivery of the NOTIFY will promote rapid replication of zone changes, but the value of doing so and the consequences of failing to do so are small. The reliability and corresponding costs of TCP is not justified.
@b0rk games are the only thing that comes to mind and even those tend to not do that these days, hm. Video calls are closest I guess?

@Lunaphied @b0rk Early games such as Doom used UDP.

Many early voice transmissions were UDP. Live audio is a good fit since you want low latency and being silent (lost packet) is tolerable. I believe modern synchronized audio transmitter/receivers on the local network are UDP based, but embed timing information so when loss happens, you can keep the audio in sync based on the explicit timing data. The human ear needs delays <30ms.

If you want some simple experiments at the cli, see netcat / nc

@trouble @Lunaphied @b0rk

early voice? The SIP protocol is still used for a lot of phone calls. SIP creates two UDP streams for audio and/or video. One from caller to callee and one from callee to caller. These streams are called RTP in SIP.

Audio stream is cut into ~20ms or 1/50 second worth of data. UDP is great for this application as a lost packet (~ 20ms) can be "back filled" by our brains.

@b0rk I think you're on the right track here. Statsd is a great example--and as I'm sure you remember, that can make your graphs wrong. There's also the Consul UDP gossip layer--remember when that DDOSed itself? 🤣
@aphyr I don't remember that Consul issue actually, I'll look it up! thanks for the pointer
@b0rk I don't know if we ever did a writeup on that one--I have this possibly mistaken memory that it was something like load + packet loss + an aggressive retry mechanism which caused a storm in the gossip layer. Might have been some kind of nack/flow control message issue too? OTOH Nelson's slides (https://www.slideshare.net/slideshow/operating-consul-as-an-early-adopter/53333600) point to churn in service watches. That might *also* be a flow control issue... @coda, you remember this one?
Operating Consul as an Early Adopter

Operating Consul as an Early Adopter - Download as a PDF or view online for free

SlideShare
@aphyr @b0rk I don’t remember any details, just that consul 0.1 was a rodeo.
@b0rk Another example I use in my classes is videogames! Lots of realtime games spray the state of the world to all clients continuously. You (handwaving here) usually only care about the current positions of players, not where they were earlier. And in fact TCP head of line blocking would amplify latency due to occasional packet loss.
@b0rk I recall NFS used to be, but I think that's pretty much gone by the wayside. TBH I can't think of a more recent tech that is "exclusively" UDP ...hmmmmm...

@PresGas @b0rk I think (udp) NFS wasn't quite spray and pray in this sense; much like DNS, the UDP packet itself might get lost but the client was expected to retry.

(The server did not retry its answers, which led to all sorts of fun. Clients were expected to retry an operation that didn't get a reply, but some operations can't be retried cleanly if they already succeeded, so servers added hacks to recognize such retried operations, and etc etc.)

@b0rk Hmm, multicast DNS (goes by names like mDNS, avahi, zeroconf) may qualify for "spray and pray". Because you don't know who's even on the LAN, you don't know whether you'll get an answer even.
@b0rk ArtNet. It's essentially UDP encapsulated DMX for lighting. Typically broadcast like DMX is, with each fixture figuring out which channels to read from the packets. Loss is tolerable since the lighting controller is continuously putting out frames.
@b0rk there's also NMEA-0183 over Ethernet, which is a common protocol in marine OT networks for broadcasting (or multicasting) sensor readings from things like GPS, compass, sonar, etc. to navigational equipment on the network. again these are loss tolerating systems with continuous updates.
@b0rk there are also a ton of industrial control protocols built around this type of design. a notable feature I've seen at least once (I'd need to do some digging to find out which protocol it was) is in alarm state broadcast protocols where they use QoS to tag the frames as being the highest priority, and send several alarm packets with the same data, to improve delivery likelihood.
@gsuberland @b0rk if you’re deliberately sending multiple copies of the same packet for redundancy, what’s the benefit over TCP and retransmits? Speed?
@witewulf @b0rk latency and broadcast (which is also partly a latency thing, since you only need to send one frame to the switch). while UDP doesn't have delivery guarantees at the protocol level, in practice there's not much reason for a UDP packet to get dropped on a dedicated local network. the repeated packets are mostly just there in case of an extremely rare bitflip.

@gsuberland @b0rk
USA NOAA NWS weather radars and associated sensors at a radar site would broadcast their raw data via UDP on the LAN, or use multicast. This enabled safe-enough addition of 3rd party research university "listeners" on-site to pick up the stream, with the listeners' ethernet NICs/cables having transmit physically disabled (not connected).

I don't think we've lost a plane on final approach to a microburst since that work. (NOAA now runs the microburst prediction.)

@b0rk FLUTE? https://www.rfc-editor.org/info/rfc6726 I've never used it but it is over UDP and it does not expect a reply.
Information on RFC 6726 » RFC Editor

@b0rk what does "spray and pray" even mean? You won't get things working by praying, instead you have to implement retries or some other strategy to handle packet losses and reordering.
Maybe it makes sense to describe how you implement UDP (if you are writing a network stack, which few people do), but not how you use UDP to implement some networking things?
@pulkomandy @b0rk "you have to implement retries" No, it depends on the application. (If you need to retry, then may be think twice before using UDP.)
@bortzmeyer @b0rk I said "retry or some other strategy", yes? This can be careful timeouts, sending another (updated?) message later, or just thinking about it and deciding that it's not important if the message is lost (but, in that case, do you really need to send it?)
@pulkomandy @b0rk " just thinking about it and deciding that it's not important if the message is lost" This is exactly how real-time video works: you don't retransmit lost pixels, the show must go on.
@b0rk regarding video protocols: typically this will be rtp or rtsp, they both have timestamps in each packet, so the receiâer can know something is missing (and how long the missing part lasts), and also if some packets are arriving too late and should be dropped. There will be no retry/retransmission in these. The complexity is mostly on the receiver side, so you can do multicast (with the sender not having to worry about how each receiver is doing)

@pulkomandy @b0rk tried looking in the other thread, and spray might be sending towards one system, or to various destinations

UDP syslog is spraying towards a logging infrastructure, sometimes resembles a firehose

I have also seen file transfer programs built using UDP just rapidly sending a lot of data, and the at the end filing the missing pieces

The old Ghost for making images onto a classroom of PCs also comes to mind
https://en.m.wikipedia.org/w/index.php?title=Ghost_(disk_utility)&diffonly=true

Ghost (disk utility) - Wikipedia

@b0rk syslog on 514/udp might be a good example

@b0rk vpns? maybe? encapsulating tcp in udp feels like it would solve some problems of tcp in tcp but i haven’t looked under the hood recently either

the decision to use udp for quic feels like an important bit of

@b0rk VoIP, RTP specifically. You can miss almost any number of them and the voice stream will restart when the packets start arriving again.

@b0rk I think the deal is that protocols layered on top of UDP do the retrying, re-implementing the parts of TCP that they need.

Edit: I had to look this up - TCP itself is not implemented on top of UDP, rather they are both built on top of IP. UDP actually came after TCP. Maybe the way to approach this line of inquiry is to ask what UDP adds to IP. And I think the answer is: ports and a data checksum.

@b0rk I think that's the difference between raw UDP and protocols built on top of UDP

@RandomDamage
I came here to say basically that. UDP is "spray and pray". Then things like QUIC or video/audio streaming protocols build complex systems and rules on what to do if packets arrive out of order or not at all, instead of depending on underlying TCP to take care of that for them.

Or I guess putting it differently, UDP is "I don't care about reliable delivery at "transport" layer, I have a better solution for that in the application" (which also may be TCP inside VPN)
@b0rk

@viq haha I was desperately trying to avoid this kind of reply explaining the basics of UDP with "(please do not reply to this explaining how UDP works)" but I guess it failed
@RandomDamage I said "please do not reply to this explaining how UDP works" for a reason, I just want answers to the specific question I asked

@b0rk sorry.

Can I offer VOIP as a place where it is also used in "spray and pray" mode?

The actual use cases are very limited, but the place to look is anywhere that latency dominates the requirements

@RandomDamage @b0rk Is VOIP actually "spray and pray"?

I think it helps to define what "spray and pray" means, and I'd say it means sending out packets without any feedback.

Request/response is not spray and pray, TCP style reliable in-order delivery is not, but also anything which does congestion control also wouldn't be considered spray and pray.

AFAIK, VOIP is generally done over RTP which does have packet loss detection and congestion control.

@b0rk one example of spray and pray would be syslog over UDP

@b0rk I'm not quite sure what counts as 'spray and pray'.

My biggest use of UDP is in VPNs, where each outer UDP packet wraps an encrypted inner IP packet. The VPN doesn't worry about acks or retries – it expects higher-layer inner protocols to do that. But _something_ is still worrying about it.

'Spray and pray' suggests multiple destinations. Perhaps a set of secret-sharing servers, so that you need any M of N to answer your query? But I don't know of anyone doing that for real.

@b0rk niche but there is a small class of "udp multicast" protocols to do parallel file distribution. They literally spray the whole blob with some error correction bits so clients can recover from missed packets. I can only find one example at the moment [1] but I think there used to be a few more floating around.

The same trick is useful on asymmetrical connections like old school satellite downlinks.

[1] https://en.wikipedia.org/wiki/UDPCast

UDPCast - Wikipedia

@b0rk some multiplayer games kind of do (did?) a similar thing, they'll stream some amount of state deltas without any ack and then do a less frequent roll-up of the whole state. Missed updates are just ignored by the client so sometimes you just "teleport" when the roll-up contains an important delta that you missed.

Very not my area of expertise so maybe games haven't done this since the 90s but I swear it was a thing at one point.

@skorgu @b0rk the fancy version of this is Fountain Coding (or early, Tornado Coding), where the entire file is intertwingled with itself in a way that allows guaranteed reconstruction when K packets are received. Long ago I did some work on distributing tornado-coded files over UDP, which had the property of not caring about retransmission or ACK.

Our metaphor for it was: it’s raining beer. Hold out your cup, and when it’s full, drink!

@b0rk syslog seems to originally have only used UDP: https://datatracker.ietf.org/doc/html/rfc3164#section-2
RFC 3164: The BSD Syslog Protocol

This document describes the observed behavior of the syslog protocol. This memo provides information for the Internet community.

IETF Datatracker
@lanodan Every implementation of TCP syslog I used was always so slow, I wonder how things are today...
@b0rk most of the UDP programming I did was multicast so it was indeed "spray". However the particular protocol I was implementing was a form of "reliable multicast" so it was more "spray and try very hard to follow up". In retrospect I think the whole project was based on local superstition that we didn't have the bandwidth for "redundant" TCP/IP streams.
@b0rk My favorite usages of UDP are: broadcasts. So stuff like Bonjour, ZeroConf, UPnP and mDNS very useful stuff.
@ivolimmen @b0rk are Bonjour, ZeroConf and mDNS not the same thing?
@unsaturated @b0rk Bonjour was originally invented by Apple. Then became zero conf (a standard). mDNS became the new name in 2013. The implementation of it from Apple is still called Bonjour.

@b0rk Syslog over UDP does that; I assume other stats/logging systems make the same trade off re simplicity and bounded work in the client VS delivery guarantees.

Otherwise, I think I've only seen un-acked sends coupled with erasure coding, for latency sensitive payloads where getting the data multiple RTTs late is useless. So sure, some amount of prayer, but only after putting extra work to let receivers cope with a couple lost packets.

@b0rk The thing is that protocols on top of UDP have to implement their own data correction / retry sytem because UDP doesn't. With TCP it would be dumb to do that, excepting maybe in very specific cases.
@doragasu haha I was desperately trying to avoid this kind of reply explaining the basics of UDP with "(please do not reply to this explaining how UDP works)" but I guess it failed
@b0rk also vpn, mqtt, etc: but then we work with higher level protocols which cares of details (pray). note for dns: microsoft send a request to each ns and hope at least one will reply, maybe implying packet will be lost frequently
@b0rk in @ParslProject our process monitoring sends updates as UDP, the reasoning being that users and the receiving code won't mind a few missing readings. That turns out to be wrong in both points: the receiving code was architected assuming reliable delivery, and users who actually care about using that data notice missing readings and report a bug... so there's a slow ongoing project to move away from UDP entirely...