• UDP: minimal transport
• Why build on UDP?
• QUIC overview and design goals
• QUIC/TLS 1.3 handshake and 0-RTT
• Streams, flow control, and head-of-line blocking
• Acking, loss detection, and congestion control
• Connection IDs, NAT rebinding, and migration
• HTTP/3 atop QUIC
• Operational notes
• Exercises

• Connectionless, no reliability, ordering, or congestion control.
• Header: src/dst port, length, checksum (optional in IPv4, mandatory in IPv6).
• Used for DNS, VoIP, gaming, VPNs, and as a substrate for custom transports.

[IP hdr][UDP hdr][Payload]; MTU considerations still apply

• User-space implementations enable rapid iteration and deployment.
• Middleboxes often allow UDP; custom reliability and CC tailored to app needs.
• Multiplexing without TCP head-of-line across streams.

• Encrypted by default, runs over UDP; integrates TLS 1.3 for security.
• Low-latency connection setup; resistant to ossification via versioning and encryption.
• Supports stream multiplexing, migration, and improved loss recovery.

• Initial packets carry TLS ClientHello; server responds with crypto parameters.
• 1-RTT for new connections; 0-RTT for resumption with replay caveats.
• Keys and secrets evolve per-direction; packet number spaces per encryption level.

• Independent bidirectional/unidirectional streams; per-stream and connection flow control.
• No TCP-style HOL across streams; only within a stream if ordered delivery chosen.
• Stream IDs and frames: STREAM, MAX_DATA, MAX_STREAMS.

• Ack-eliciting packets; ACK ranges; loss detection via timers and packet thresholds.
• Congestion control typically CUBIC/BBR-like; pacing recommended.
• Spin bit and qlog for observability; path validation for anti-amplification.

• Connection IDs decouple identity from 5-tuple; survive NAT rebinding.
• Active migration enables path changes; requires path validation and anti-amplification.
• Load balancing and stateless reset supported via dedicated frames.

• Maps HTTP semantics onto QUIC streams; control streams separate from request streams.
• QPACK for header compression avoids HOL; server push deprecated.
• Better performance under loss/latency variance vs HTTP/2 over TCP.

• Firewalls/NAT: allow UDP 443; ensure state timeouts handle long-lived flows.
• Observe with server logs and qlog; packet capture visibility limited by encryption.
• Fallback to TCP/HTTP/2 if QUIC blocked; monitor handshake failure rates.

1. Capture a QUIC handshake and identify Initial/Handshake/1-RTT packet number spaces.
2. Compare page load times with HTTP/3 enabled vs disabled on a test site.
3. Simulate NAT rebinding and verify QUIC connection migration.