Fortify Visibility and Security with QUIC Traffic Inspection
Harness the Modern Web While Staying Secure
Overview
An Introduction to the QUIC Protocol
Developed originally by Google and later standardized by the Internet Engineering Task Force (IETF) in RFC 9000, QUIC is a general-purpose, transport-layer network protocol designed to improve the performance of connection-oriented web applications. Unlike traditional HTTP, which relies on TCP (Transmission Control Protocol), QUIC is built on top of UDP (User Datagram Protocol). It integrates TLS 1.3 handshake by default, combining transport and cryptographic handshakes to reduce latency.
Benefits
A High-Performance Protocol Designed for the Modern Web
For network and security architects, these protocols represent a shift in how traffic is managed and secured:
Low latency & 0-RTT
QUIC’s "Zero Round-Trip Time" (0-RTT) handshake significantly improves user experience by allowing data transmission to start before the handshake is fully complete for repeat connections. However, this creates challenges for traditional firewalls that expect a standard TCP three-way handshake.
Connection migration
QUIC allows a connection to stay alive even if a user’s IP address changes (e.g., switching from Wi-Fi to 4G). While excellent for mobility, it requires security tools that can track sessions beyond a simple IP/port tuple.
Encrypted by default
Because QUIC is encrypted from the first packet, network-level inspection (without a proxy) is impossible. This makes "blind" QUIC traffic a potential blind spot for data exfiltration or malware delivery.
QUIC HANDSHAKE OVERVIEW
How QUIC’s Connection Flow Operates in Real-World Traffic
The QUIC handshake is a streamlined process that merges the transport and security layers:
Traditional six-step TCP and TLS exchange vs. QUIC connection process
Client Hello
The client sends a packet containing both the QUIC transport parameters and the TLS 1.3 Client Hello message.
Server Hello
The server responds with its Server Hello message, encrypted extensions, and certificates.
1-RTT Data
Immediately following the response, both sides can exchange encrypted application data.
DRIVING INNOVATION
On the Horizon: QUIC’s Evolution
As with other aspects of network infrastructure, the QUIC protocol is not a static “one and done” effort. There are new innovations pushing this protocol forward to deliver benefits for both web app developers and end users alike:
Media-over-QUIC (MoQ)
An emerging IETF protocol designed for the ultra-low-latency delivery of live audio, video, and data over the internet, MoQ leverages the QUIC transport layer—the same foundation as HTTP/3—to solve the "trilemma" of modern streaming: achieving scale, low latency, and high reliability simultaneously.
WebTransport
This is a developing API that uses QUIC and HTTP/2 to provide low-latency, bidirectional data transfer for use cases like cloud gaming and high-frequency trading, offering even more flexibility than WebSockets.
Zscaler Now Inspects Post-Quantum Cryptography (PQC) Traffic
VISIBILITY AND CONTROL AT SCALE
Zscaler’s Zero Trust Exchange, the world’s largest security cloud platform, is uniquely positioned to inspect and secure QUIC traffic, ensuring that performance benefits do not come at the cost of security.
SUPPORT FOR NATIVE QUIC INSPECTION
Intelligent QUIC Inspection Drives Effective Security Outcomes
Zscaler has evolved its approach to QUIC traffic and now supports native inspection of QUIC/HTTP/3 traffic. Instead of forcing a fallback, Zscaler can now directly inspect the encrypted QUIC flows. This allows organizations to leverage the performance advantages of QUIC such as Head-of-Line blocking while still applying security policies.
Native inspection is available for Transparent Redirection modes, specifically:
- Zscaler Client Connector (ZCC)
- Zero Trust Branch
- IPsec and GRE Tunnels
By enabling native QUIC inspection, Zscaler ensures that HTTP/3 traffic is treated with the same rigor as traditional web traffic and drives significant security outcomes:
Advanced security
Provides full support for Advanced Threat Protection (ATP) and Sandbox analysis, ensuring that malware cannot be delivered through uninspected QUIC streams.
Data protection
Enables Data Loss Prevention (DLP) for QUIC traffic. This is increasingly critical as Generative AI applications and modern SaaS platforms move toward QUIC as their primary transport.
Granular policy control
Administrators can create and enforce policies specifically for QUIC/HTTP/3, ensuring it is no longer a "blind spot" in the corporate network.
Visibility and audit
Every QUIC session is fully logged and reported, providing the necessary data for compliance, forensic investigations, and operational troubleshooting.
ADDITIONAL BENEFITS OF QUIC
Retains the speed and latency benefits of HTTP/3 without the overhead of protocol fallback.
Closes the "UDP Blind Spot" by applying deep packet inspection, ATP, and DLP to native QUIC flows.
Secures the rapid adoption of AI-driven applications that increasingly rely on QUIC for real-time responsiveness.
Provides a unified security workflow and consistent logging across both TCP and UDP-based web traffic.
Learn more from Zscaler’s Security Experts
See how Zscaler’s innovations in decrypting and inspecting PQC traffic can help your organization become quantum-ready.