QUIC
A transport-layer protocol running over UDP with built-in TLS encryption, multiplexing, and flow control. Compared with TCP, it reduces the number of round trips required for connection establishment and improves tolerance of packet loss.
Core Facts
QUIC supports multiplexing, where packet loss on a single stream does not block other streams, solving TCP's head-of-line blocking problem.
QUIC is a transport-layer protocol designed by Google and later standardized by IETF, and has become the underlying transport for HTTP/3.
Timeline (last 90 days)
QPACK runs on top of QUIC, where multiple QUIC streams may arrive out of order; directly reusing HPACK would cause head-of-line blocking.
In the window before a connection is fully validated, if the server implementation allows Initial or 0-RTT data carrying large header blocks, a limited amplification surface may still form.
After the connection is established, an attacker who already holds a valid connection can repeatedly trigger high-cost responses within the same connection.
QUIC's handshake phase includes source address validation mechanisms (such as Retry packets and address validation tokens), which in theory can mitigate pure reflection-based abuse.
GET /api/quic-0rtt-replay-risk?host=<HOST> sends a hand-crafted QUIC Initial packet conforming to RFC 9000 §17.2 to the target's UDP/443 port, detects the stateless Retry mechanism, infers whether an anti-replay token exists, and heuristically judges 0-RTT support via TLS 1.3 ALPN=h3 and Alt-Svc=quic.
The QUIC 0-RTT replay risk endpoint returns fields including whether QUIC is advertised, negotiated version, 0-RTT support, stateless Retry support, anti-replay token presence, replay risk level (none/low/medium/high/critical) and an A-F rating.
QUIC 0-RTT allows clients to send early data before the handshake completes, but if the target does not implement the stateless Retry specified in RFC 9000 §8 or the session ticket rotation of RFC 9001 §4.6.1, a passive observer may capture the early data stream and replay it.
QUIC is a UDP-based transport-layer protocol designed by Google and standardized by the IETF as RFC 9000, aimed at reducing connection establishment latency and improving multiplexing efficiency.
The developer positions the QUIC 0-RTT replay risk endpoint as a forward-looking bet; the risk is currently mostly theoretical but could escalate into a practical concern within 12 months.
iroh is a QUIC-based peer-to-peer networking library that uses public key addressing rather than IP addresses.
8 more timeline events
All Facts (20)
QUIC supports multiplexing, where packet loss on a single stream does not block other streams, solving TCP's head-of-line blocking problem.
65%VerifiedQUIC is a transport-layer protocol designed by Google and later standardized by IETF, and has become the underlying transport for HTTP/3.
65%UnverifiedMoQ基于QUIC构建，允许不同的媒体流设置不同的可靠性级别
90%UnverifiedSolana通过QUIC协议升级和本地费用市场（Local Fee Markets）等改进提升了网络稳定性
85%UnverifiedQUIC's handshake phase includes source address validation mechanisms (such as Retry packets and address validation tokens), which in theory can mitigate pure reflection-based abuse.
50%UnverifiedAfter the connection is established, an attacker who already holds a valid connection can repeatedly trigger high-cost responses within the same connection.
50%UnverifiedQPACK runs on top of QUIC, where multiple QUIC streams may arrive out of order; directly reusing HPACK would cause head-of-line blocking.
50%UnverifiedQUIC is a UDP-based transport-layer protocol designed by Google and standardized by the IETF as RFC 9000, aimed at reducing connection establishment latency and improving multiplexing efficiency.
50%UnverifiedQUIC 0-RTT allows clients to send early data before the handshake completes, but if the target does not implement the stateless Retry specified in RFC 9000 §8 or the session ticket rotation of RFC 9001 §4.6.1, a passive observer may capture the early data stream and replay it.
50%UnverifiedThe QUIC 0-RTT replay risk endpoint returns fields including whether QUIC is advertised, negotiated version, 0-RTT support, stateless Retry support, anti-replay token presence, replay risk level (none/low/medium/high/critical) and an A-F rating.
50%UnverifiedGET /api/quic-0rtt-replay-risk?host=<HOST> sends a hand-crafted QUIC Initial packet conforming to RFC 9000 §17.2 to the target's UDP/443 port, detects the stateless Retry mechanism, infers whether an anti-replay token exists, and heuristically judges 0-RTT support via TLS 1.3 ALPN=h3 and Alt-Svc=quic.
50%Unverifiediroh is a QUIC-based peer-to-peer networking library that uses public key addressing rather than IP addresses.
50%UnverifiedQUIC is a transport layer protocol running on top of UDP, with built-in TLS encryption, multiplexing, and flow control; compared with TCP it can reduce the number of round trips for connection establishment and is more tolerant of packet loss.
50%UnverifiedHTTP/3 uses the UDP-based QUIC protocol, which achieves true inter-stream independence at the transport layer, fundamentally avoiding the Head-of-Line Blocking problem.
50%UnverifiedQUIC runs on top of UDP, resolves TCP's head-of-line blocking problem, and reduces the number of round trips for an initial connection from 2–3 RTTs to 1 RTT, with 0-RTT resumption possible for known servers.
50%UnverifiedHTTP/3 is the next-generation HTTP standard based on the QUIC transport protocol, officially published by the IETF in 2022 (RFC 9114).
50%UnverifiedQUIC uses independent connection IDs to identify sessions and decouples them from the underlying IP address, allowing connections to migrate seamlessly when a device switches networks.
50%UnverifiedSSH3 was developed by researchers at the French institution INRIA and rebuilds the SSH protocol on top of HTTP/3 (based on QUIC); it is still in an experimental stage.
50%UnverifiedQUIC was originally developed by Google in 2012 (originally named gQUIC) and was standardized by the IETF as RFC 9000 in 2021.
50%UnverifiedSSH3 was developed by researchers at the French research institution INRIA, with the core idea of using HTTP/3 (based on the QUIC protocol) as the transport layer.
50%