# QUIC HTTP 3 support?

**URL:** <https://community.zeek.org/t/quic-http-3-support/5575>\
**Category:** Zeek\
**Created:** [January 9, 2019, 12:39am UTC](https://community.zeek.org/t/quic-http-3-support/5575 "2019-01-09T00:39:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\
**Post date:** [January 9, 2019, 12:39am UTC](https://community.zeek.org/t/quic-http-3-support/5575/1 "2019-01-09T00:39:29Z")

</div>

Hello Zeekers,

Does Zeek support Quic HTTP 3?

[https://tools.ietf.org/html/draft-ietf-quic-http-17](https://tools.ietf.org/html/draft-ietf-quic-http-17)

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [January 9, 2019, 3:58am UTC](https://community.zeek.org/t/quic-http-3-support/5575/2 "2019-01-09T03:58:34Z")

</div>

I am confident that once the HTTP/3 specification is completed Zeek will support it.

-AK

---

<div class="post-metadata">

**Author:** ![dopheide](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@dopheide](https://community.zeek.org/u/dopheide)\
**Post date:** [January 9, 2019, 4:22am UTC](https://community.zeek.org/t/quic-http-3-support/5575/3 "2019-01-09T04:22:31Z")

</div>

There are two packages you might want to check out. The first one I wrote as a sample which does a very basic job of trying to identify a connection as being Google QUIC or IETF draft. (In practice, I saw zero traffic actually adhering to the IETF draft, all QUIC traffic was Google’s version.) The second is a Corelight re-write that does a much more in-depth analysis of Google QUIC.

[https://github.com/dopheide-esnet/bro-quic](https://github.com/dopheide-esnet/bro-quic)  
[https://github.com/corelight/bro-quic](https://github.com/corelight/bro-quic)

-Dop

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/quic-http-3-support/5575/4 "2022-05-06T15:46:16Z")

</div>


