Transmission Control Protocol operates at the transport layer and underpins many application protocols, including HTTP/1.1, HTTP/2, and common database protocols. A TCP connection is normally established through a three-way handshake: SYN, SYN-ACK, and ACK. Endpoints track sequence numbers and acknowledge received data, allowing missing segments to be retransmitted and data to be presented to the application in order. TCP provides a byte stream rather than application message boundaries, so applications must define their own framing.
Reliability has costs. Connection establishment adds latency, acknowledgments and retransmissions consume bandwidth, and a missing segment can delay delivery of later bytes on the same connection. Throughput depends on factors including round-trip time, packet loss, congestion control, and receive-window size. TCP does not guarantee that communication will eventually succeed through a permanent outage, nor does an acknowledgment prove that the receiving application has committed a transaction.
In cloud load balancing, distinguish the listener protocol, target group protocol, and target type. The listener defines how clients connect to the load balancer. The target group protocol defines how traffic is delivered to backends. The target type identifies how those backends are registered. These are related configuration choices, but they describe different things: TCP and GENEVE are protocols, whereas instance and IP are target types.
For example, an AWS Network Load Balancer can accept TCP connections on port 5432 and direct each connection to a database proxy in a TCP target group. With instance targets, registration uses EC2 instance IDs and traffic reaches each instance through its primary private IP address on its primary network interface. With IP targets, registration uses supported IP addresses directly, which accommodates independently addressed container tasks and reachable private backends outside the load balancer VPC. Publicly routable IP addresses cannot be registered as IP targets. Registration alone does not establish routing or permit traffic through firewalls.
GENEVE serves a different purpose. AWS Gateway Load Balancer uses GENEVE encapsulation over UDP port 6081 to exchange traffic with network appliances. An encapsulated packet can contain a TCP connection, but that does not make the appliance target group a TCP target group. Choose this model for transparent appliance inspection rather than ordinary TCP application distribution. Application Load Balancer instead uses HTTP or HTTPS target groups for application-aware routing; it is not a generic TCP load balancer.
Security also requires separating transport from encryption. A TCP listener on port 443 does not itself enable TLS. It can pass an application's TLS session through to a backend that terminates encryption. A TLS listener terminates the client TLS session at the load balancer, and its backend configuration determines whether the next connection is encrypted. Security groups are stateful, while network ACLs are stateless and require appropriate rules for both directions, including return traffic to ephemeral ports.
For availability, distribute targets across Availability Zones and configure health checks, deregistration behavior, and connection timeouts deliberately. A successful TCP health check demonstrates that a connection can be established, not that an application dependency or business operation works. Existing connections cannot simply migrate to another backend when their target fails; clients need reconnection logic and carefully designed retries. Connection draining helps during planned changes, while application-level idempotency prevents retried operations from creating duplicate effects.
Amazon VPC