Hello and welcome to the Thursday, June 18th,

2006 edition of the Sands and then at Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sandsdot edu bachelor's degree program in

applied cyber security. If you didn't know it as part of the bachelor's program, you're actually

going to do an internship as one of the options with the internet storm center, looking at

Honeypot alerts and essentially figuring out sort of what's going on

there out in the internet. Today we do have a guest post by Barun Murdula, who writes about

Quick and better actually HTTP 3 in this particular case. Quick is one of those weird

protocols. Probably should have been

a transport layer protocol like TCP and UDP, but well, that wasn't really feasible, so

Google decided to actually go with sort of a new protocol layer over UDP. Now, this is a protocol that has become really popular recently.

I believe latest numbers I've seen is something like 30% of web traffic is using Quick

these days.

It's supported by all the major browsers and many web servers.

The problem, of course, with a very new and different

protocol like this, in particular, since it's encrypted and there is no sort of clear text

version of Quick, is that your good old inspection tools don't really work well. All

HTTP TLS inspection tools typically rely on setting up a proxy.

And that's sort of what that diary is about that, well, once you're using Quick,

these proxies become pretty much blind for what's actually going on on your network.

So really one of the few options that you have to deal with this is to block any UDP packets,

...