First time here? Check out the FAQ!

Ask Your Question
0

Can wireshark be set up to differentiate if a QUIC pcap is GQUIC or IETF QUIC?

asked May 5 '2

Can wireshark be set up to differentiate if a QUIC pcap is GQUIC or IETF QUIC?

Preview: (hide)

1 Answer

Sort by » oldest newest most voted
0

answered May 6 '2

Chuckc gravatar image

Maybe.
View->Internals->Dissector Tables then search on "quic".
GQUIC and QUIC are registered as udp Heuristics.
From the WSUG (User's Guide):

As Wireshark tries to find the right dissector for each packet (using static “routes” and heuristics “guessing”), it might choose the wrong dissector in your specific case.

Wireshark makes a SWAG and does it's best.

There are captures attached to 13881 - Add (IETF) QUIC Dissector and 15984 - gquic parser Q046 support that show each protocol dissected.

Preview: (hide)
link

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: May 5 '2

Seen: 297 times

Last updated: May 06 '22