8 ms·
(author of this site here) This is correct, you can recognize Initial packets easily/reliably, and they contain the connection IDs in plaintext so that a state
by syncsynchalt 3y ago
(author of this site here)
This is correct, you can recognize Initial packets easily/reliably, and they contain the connection IDs in plaintext so that a stateful packet filter/shaper can recognize individual data flows.
Note that packet numbers (and everything else other than port/IP) are encrypted, so you can't do more than drop or delay the packets. But blocking/shaping/QoS is perfectly doable.
- Dylan16807 3y agoI want to be clear that I was talking about checking the encryption of the very first packet, which isn't secret yet. Once keys are already established I don't see any particularly reliable test for a single packet, but as you say the connection ids are accessible so if they're in the right place in both directions then that looks good for discovering a QUIC flow.