Skip to content

SYSTEM Cited by 1 source

QUIC

QUIC (RFC 9000) is a general-purpose, connection-oriented, encrypted transport protocol that runs over UDP. It was standardized at the IETF (originally from Google's "gQUIC") and is the transport underneath HTTP/3. QUIC folds the transport handshake and the TLS 1.3 cryptographic handshake together, multiplexes many independent application streams over one connection, and moves transport logic (loss recovery, congestion control, flow control) into user space on top of a thin UDP datagram layer.

QUIC appears across much of the wiki corpus as the substrate for low-latency, loss-resilient communication — media transport (MoQ, RUSH), edge/CDN proxies, DNS, and KV data planes.

Why it exists — the problems with TCP+TLS

  • Cross-stream head-of-line blocking — HTTP/2 multiplexes streams over a single TCP connection, so one lost packet stalls every multiplexed stream until retransmission. QUIC gives each stream its own independent delivery, so loss on one stream doesn't block the others — the single most-cited reason QUIC carries real-time media better than TCP.
  • Slow connection setup — TCP's SYN handshake plus a separate TLS handshake costs multiple round trips. QUIC combines them and supports 0-RTT / 1-RTT setup, cutting first-byte latency.
  • No connection migration — a TCP connection is pinned to the 4-tuple (IPs + ports), so a client switching Wi-Fi↔cellular must reconnect. QUIC identifies connections by a connection ID, so a session survives a network change (connection migration) — essential on mobile.
  • Ossified, kernel-bound transport — TCP evolution is gated on OS kernels and middleboxes. QUIC lives in user space with an encrypted header, so transport features can ship at application cadence and middleboxes can't ossify the wire.

Key properties

  • Built on UDP — rides UDP/443; needs a fallback where UDP is blocked (see below).
  • Independent streams — multiplexing without TCP-style HOL blocking.
  • Encrypted by default — TLS 1.3 integrated; headers largely encrypted, which hides framing from middleboxes and from the operator's own packet captures (a real debugging constraint — see MoQ-aware tracing below).
  • Connection migration — session continuity across IP/port changes.
  • Pluggable congestion control — Reno/CUBIC/BBR etc. in user space.
  • Extensible — new features (e.g. FEC, forward error correction) can be added to QUIC and inherited by every protocol layered on it.

Firewall traversal — the UDP/443 problem

UDP/443 is blocked or rate-limited on a non-trivial slice of enterprise and carrier networks, so QUIC-based applications must carry a TCP fallback. A common tactic (used by Meta for MoQ ingest) is to race the handshakes at session start and keep whichever transport — QUIC or TCP — wins, for the rest of the session (a happy-eyeballs-style transport negotiation). (Source: sources/2026-10-12-meta-shipping-media-over-quic-at-meta-scale-for-instagram-live-ingest)

Implementations on the wiki

  • mvfst — Meta's C++ QUIC implementation (powers moxygen / MoQ).
  • quiche — Cloudflare's Rust QUIC/HTTP-3 library.
  • quic-go — the Go QUIC implementation.

Protocols layered on QUIC (on the wiki)

  • HTTP/3 — the original motivating application.
  • MoQ Transport — pub/sub media delivery; a publisher pushes named Tracks to relays, subscribers pull by name.
  • RUSH — Meta's QUIC-based live-ingest protocol, predecessor to MoQ.
  • WebTransport — a browser-exposed API over HTTP/3 (and an HTTP/2 TCP mapping).

Seen in

  • sources/2026-10-12-meta-shipping-media-over-quic-at-meta-scale-for-instagram-live-ingest — the load-bearing substrate for MoQ on Instagram Live ingest. Meta chose MoQ partly so live media "would also automatically benefit from any feature added to QUIC (e.g., FEC)." QUIC's per-stream independence (no HOL blocking), fast setup, and connection migration are cited as the reasons QUIC carries live and real-time media; Meta's earlier QUIC rollout achieved lower request errors, tail latency, and video stalls than HTTP/2. The post also surfaces QUIC's two operational costs at scale: UDP/443 is blocked on some networks (forcing per-session transport selection) and QUIC encryption hides framing from packet captures (forcing purpose-built MoQ-aware tracing at the edge).
Last updated · 854 distilled / 2,448 read