3 ms·
Really? How.. Can you please tell me how I can detected QUIC looking at bytes. I could drop then only QUIC and not UDP/443.
by Borg3 3y ago
Really? How.. Can you please tell me how I can detected QUIC looking at bytes.
I could drop then only QUIC and not UDP/443.
- Dylan16807 3y agohttps://quic.xargs.org/ https://quic.xargs.org/ The quick test is that the first packet is generally going to start with hex C[any nibble]00000001 and be exactly 1200 bytes long, ending with a bunch of 0s. A better test is to see if the full header makes sense, extract the initial encryption key, and check if the rest of the packet matches the signature.
- syncsynchalt 3y ago(author of this site here) This is correct, you can recognize Initial packets easily/reliably, and they contain the connection IDs in plaintext so that a stateful packet filter/shaper can recognize individual data flows. Note that packet numbers (and everything else other than port/IP) are encrypted, so you can't do more than drop or delay the packets. But blocking/shaping/QoS is perfectly doable.
- Dylan16807 3y agoI want to be clear that I was talking about checking the encryption of the very first packet, which isn't secret yet. Once keys are already established I don't see any particularly reliable test for a single packet, but as you say the connection ids are accessible so if they're in the right place in both directions then that looks good for discovering a QUIC flow.