QUIC is a transport protocol originally developed at Google and standardised by the IETF in 2021 (RFC 9000). It runs over UDP, but provides what TCP plus TLS provide (reliable, ordered, secure streams), with important improvements for today’s internet, especially mobile and long-distance connections. It’s the foundation of HTTP/3, and is also used by DNS over QUIC, some VPNs and media protocols.

Why a new transport?

TCP is decades old and built into operating system kernels, which makes changing it slow. It also has structural limits for the modern web:

  • head-of-line blocking: one lost packet stalls everything on the connection;
  • separate handshakes: TCP and then TLS, costing round trips before any data flows;
  • connections tied to IP and port: switching networks breaks them;
  • middleboxes have come to depend on TCP details, which makes extensions hard to deploy (“ossification”).

QUIC moves the transport into user space over UDP, encrypts almost everything (including most transport headers), and redesigns these parts.

Key features

Independent streams

A QUIC connection carries many streams. Packet loss on one stream only delays that stream. Others keep flowing. For HTTP/3, that means a lost packet carrying image data doesn’t hold up the CSS.

Built-in TLS 1.3 and faster setup

The cryptographic handshake is part of the transport handshake:

  • 1-RTT for new connections (vs TCP + TLS 1.3 = 2 RTT before the first request);
  • 0-RTT for returning clients. The first request is sent immediately, with replay-safety caveats, so servers only allow it for idempotent requests.

On a 150 ms path, saving a round trip saves 150 ms per new connection. See latency vs bandwidth.

Connection migration

Connections are identified by connection IDs, not the IP/port 4-tuple. When a phone moves from Wi-Fi to mobile data, the connection continues, with no new handshake.

Encrypted, extensible transport

Most of the QUIC header is encrypted or authenticated, so middleboxes can’t depend on or tamper with internal details. That makes future evolution easier, and reduces tracking surface.

Modern congestion control

Implementations can use CUBIC, BBR or others, in user space, so improvements ship quickly with browsers and servers. See TCP BBR.

Operating QUIC on your servers

Firewalls: QUIC uses UDP, usually on port 443. Open it alongside TCP 443:

sudo ufw allow 443/udp

If UDP is blocked, clients silently fall back to HTTP/2 over TCP, so the site still works, just without QUIC’s benefits.

Web servers and proxies: Nginx (1.25+, with QUIC enabled at build time), Caddy, LiteSpeed/OpenLiteSpeed, HAProxy 2.6+ and Envoy support HTTP/3. Advertise it with Alt-Svc. See HTTP/2 and HTTP/3 in Nginx.

Load balancers: layer-4 balancing of QUIC needs to keep packets of one connection on the same backend, even when the client’s IP changes. That needs connection-ID-aware routing, or terminating QUIC at the load balancer. Many setups simply terminate HTTP/3 at the edge (CDN or proxy), and use HTTP/1.1 or HTTP/2 to backends. See load balancer types.

CPU: QUIC in user space with per-packet encryption costs more CPU per byte than kernel TCP with TLS. That’s relevant for very high throughput servers, and less so for typical websites. Implementations keep improving (GSO and batching).

DDoS and rate limiting: UDP-based services need attention to amplification and spoofing. QUIC includes address validation (retry tokens) to mitigate this.

Debugging QUIC

Because QUIC is encrypted, tcpdump shows only UDP packets. Tools:

curl --http3 -v https://example.com          # curl built with HTTP/3 support
curl -sI https://example.com | grep -i alt-svc
  • Browser DevTools show h3 in the Protocol column.
  • qlog (a structured QUIC log format) plus qvis visualise connections. Many servers and libraries can emit qlog.
  • Wireshark decrypts QUIC if you provide the TLS key log (SSLKEYLOGFILE) from the client.

See tcpdump.

Beyond HTTP/3

  • DNS over QUIC (DoQ): encrypted DNS with QUIC’s low latency.
  • WebTransport: low-latency, bidirectional streams and datagrams for web apps (games, live media).
  • MASQUE: proxying and VPN-like tunnelling over QUIC (used by some privacy relays).
  • Media over QUIC: emerging live streaming protocols.

Quick reference

Feature Benefit
UDP-based, user space Faster evolution, no kernel changes
Independent streams No head-of-line blocking across streams
Integrated TLS 1.3 1-RTT setup, 0-RTT resumption
Connection IDs Survives network changes
Encrypted headers Less ossification, more privacy
Port UDP 443 (open it in the firewall)

Related: HTTP/1.1 vs HTTP/2 vs HTTP/3 and MTU explained.

  • Networking
  • HTTP
  • Web Performance