Search code examples
network-programmingudpquic

Identify a QUIC Packet in UDP Payload

I am trying to write a custom code that processes QUIC Initial packets. In a pcap file, I would like to identify quic packet from other UDP packets. I am not sure on which particular bit/ byte in the payload to look for.

An Example

The payload directly seems to start with quic headers. How to distinguish this from other UDP payloads like DNS, etc.

Solution

  • Actually, there is no bit or field in the UDP header providing you information about the type of payload. You were probably searching for something like the Protocol field in the IPv4 header.

    Wireshark uses so-called dissectors to determine the type of payload. You can find the QUIC dissector here. Wireshark uses multiple techniques to determine if a UDP datagram contains QUIC payload. Some of them are:

    • is the port used 80 or 443? If yes, the payload could be QUIC.
    • is the beginning of the payload a valid QUIC header? This includes the verification of the QUIC version or the validation of the CID.

    If you try to implement a simple dissector on your own, I would probably use the "easy" properties mentioned above.

    I hope this does answer your question.