4

I've been using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?

1
  • I used udp as filter, but all the packets that I see are quic protocol Feb 16, 2016 at 22:42

3 Answers 3

6

Wireshark uses dissectors and lua scripts to analyze and classify capture traffic (or parts thereof). What is displayed in the Protocol field of Wireshark's Packet List Pane is the information returned that is most specific after analyzing the data and will determine how the data is presented.

If the UDP dissector is the most specific dissector for the captured data, than the Protocol column will show UDP. However many types of UDP traffic will be identified (SIP, RTP, DNS, etc).

The same is true for TCP traffic as well. Typically you will see this as HTTP, FTP, IRC, etc.

I've using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?

In your case because the traffic has been analyzed as QUIC data. It may or may not be QUIC traffic; no program of this type is perfect, but Wireshark will be correct more often than not.

QUIC is one of the "newer" classifications, as it appears to have been added in 1.11.3/1.12.0. If you were using a version of Wireshark prior to these versions, the same traffic may likely have been classified as UDP (or another protocol).

If you don't want the QUIC protocol to be identified, simply go to the "Analyze" menu and select "Enabled Protocols" from the list. Find the entry for QUIC and uncheck the box.

3

QUIC runs atop UDP, so a QUIC packet is a (normal) UDP packet.

Wireshark currently treats all UDP packets to or from ports 80 and 443 as QUIC packets - even if they aren't. Are the UDP packets in question going to or from one of those ports? And are they, in fact, QUIC?

1

If you see QUIC, you are seeing UDP. Unless you are sending UDP segments without QUIC, you won't see only UDP.

From A UDP-Based Secure and Reliable Transport for HTTP/2 draft-tsvwg-quic-protocol-02:

QUIC (Quick UDP Internet Connection) is a new multiplexed and secure transport atop UDP, designed from the ground up and optimized for

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.