What is QUIC, why does it run over UDP, and what does it change for network engineers?
Show the answer
Say this first
QUIC (RFC 9000) is a reliable, multiplexed, encrypted transport built on UDP, normally on port 443 under HTTP/3. It has its own streams, retransmission, flow control and congestion control, with TLS 1.3 built into the handshake, so a new connection is ready in one round trip. It uses UDP because a new IP protocol would be blocked by NAT and firewalls and would need kernel changes everywhere; UDP passes through and QUIC can live in user space. For network teams it means almost everything is encrypted, including ACKs, so firewalls see far less, MSS clamping does not apply, and UDP idle timeouts matter.
Go deeper
Features worth naming
- Connection IDs instead of the four-tuple identify a connection, so a phone moving from Wi-Fi to LTE keeps its connection (connection migration).
- Streams are independent: a loss stalls only its own stream.
- Packet numbers never repeat, so retransmissions are not ambiguous for RTT measurement.
- 0-RTT on resumption, with the same replay caveats as TLS 1.3.
- Header protection encrypts packet numbers. On-path devices see little more than the destination connection ID and a few flag bits, including an optional spin bit that lets them estimate RTT.
Sizes and safety
- The client pads its first Initial datagram to at least 1,200 bytes, and QUIC assumes the path carries at least 1,200-byte UDP payloads.
- Before the client's address is validated, a server may send at most three times the bytes it received, which limits amplification attacks.
What the network can and cannot see
Initial packets are encrypted with keys derived from the connection ID that is sent in clear, so any middlebox can decrypt them and read the ClientHello, including the SNI. Everything after the handshake is opaque. A firewall that wants TLS inspection or URL filtering has to block UDP 443 and force a TCP fallback.
They will ask next
How does a load balancer keep QUIC packets going to the right server after a client changes address?
It cannot use the four-tuple, because that changes. It routes on the connection ID, which servers generate so that it encodes or maps to the right backend.
Should an enterprise block QUIC?
It is a policy trade-off. Blocking UDP 443 restores visibility for inspection tools and the browser falls back to TCP. Allowing it gives users better performance on lossy and mobile networks.
Traps
- Saying QUIC is unreliable because it runs over UDP. It provides its own reliability.