set long enough to also allow for short idle time during a valid transmission. <del> RFC4787 requires a timeout that is not less than 2 minutes for most UDP traffic.  However, in practice, timers are sometimes lower, in the range of 30 to 60 seconds.  In contrast, RFC5382 recommends a timeout of more than 2 hours for TCP, given that TCP is a connection- oriented protocol with well- defined closure semantics. Even though QUIC has explicitly been designed to tolerate NAT rebindings, decreasing the NAT timeout is not recommended, as it may negatively impact application performance or incentivize endpoints to send very frequent keep-alive packets.  Instead it is recommended, even when lower timers are used for other UDP traffic, to use a timer of at least two minutes for QUIC traffic. </del>  If state is removed too early, this could lead to black-holing of incoming packets after a short idle period.  To detect this

This is an attempt to clearly say what the problem is with NAT state timeout and what is a recommended approach.
As this is advice for network operators and middlebox vendors, this reads to me as permission to use a lower timeout. I think that it still makes sense to maintain the recommendation in RFC 4787. The advice for applications (don't rely on 2 minutes) still applies, but a 2 minute recommendation is worth sticking to.
I thought the text is pretty clear in saying that a bit later: I would rather want to keep this part because the message really is: yes we know these too short timers are implemented for UDP but please, please use at least 2 minutes for QUIC. Maybe removing some paragraph breaks would make it clearer that these parts belong together? Also this part got now edited quite extensively, so I rather not change it again...
Each of the sentences looks fine to me, but together I also have a hard time seeing the recommendation v. current experience. Here is a proposal: .
This is better. With Mirja's suggestion.

set long enough to also allow for short idle time during a valid transmission.  <ins> RFC4787 requires a network state timeout that is not less than 2 minutes for most UDP traffic.  However, in practice, a QUIC endpoint can experience lower timeouts, in the range of 30 to 60 seconds. In contrast, RFC5382 recommends a state timeout of more than 2 hours for TCP, given that TCP is a connection-oriented protocol with well- defined closure semantics.  Even though QUIC has explicitly been designed to tolerate NAT rebindings, decreasing the NAT timeout is not recommended, as it may negatively impact application performance or incentivize endpoints to send very frequent keep-alive packets. The recommendation is therefore that, even when lower state timeouts are used for other UDP traffic, a state timeout of at least two minutes ought to be used for QUIC traffic. </ins> If state is removed too early, this could lead to black-holing of incoming packets after a short idle period.  To detect this


4.10. <del> Some networks support 1500-byte packets, but can only do so by fragmenting at a lower layer before traversing a smaller MTU segment, and then reassembling.  This is permissible even when the IP layer is IPv6 or IPv4 with the DF bit set, because it occurs below the IP layer.  However, this process can add to compute and memory costs, leading to a bottleneck that limits network capacity.  In such networks this generates a desire to influence a majority of senders to use smaller packets, so that the limited reassembly capacity is not exceeded. </del>  For TCP, MSS clamping (Section 3.2 of RFC4459) is often used to <del> change the sender's maximum TCP segment size, but QUIC requires a </del>  different approach.  Section 14 of QUIC-TRANSPORT advises senders to probe larger sizes using Datagram Packetization Layer PMTU Discovery (DPLPMTUD) or Path Maximum Transmission Unit Discovery (PMTUD: <del> RFC1191 and RFC8201).  This mechanism will encourage senders to approach the maximum size, which could cause fragmentation with a network segment that they may not be aware of. </del>  <del> If path performance is limited when sending larger packets, an on- </del>  path device should support a maximum packet size for a specific transport flow and then consistently drop all packets that exceed the configured size when the inner IPv4 packet has DF set, or IPv6 is <del> used.  Endpoints can cache PMTU information between IP flows, in the IP-layer cache, so short-term consistency between the PMTU for flows can help avoid an endpoint using a PMTU that is inefficient. </del>  Networks with configurations that would lead to fragmentation of <del> large packets should drop such packets rather than fragmenting them. Network operators who plan to implement a more selective policy may start by focusing on QUIC.  QUIC flows cannot always be easily distinguished from other UDP traffic, but we assume at least some portion of QUIC traffic can be identified (see sec-identifying).  For QUIC endpoints using DPLPMTUD it is recommended for the path to drop a packet larger than the supported size.  A QUIC probe packet is used to discover the PMTU.  If lost, this does not impact the flow of QUIC data. </del>  IPv4 routers generate an ICMP message when a packet is dropped because the link MTU was exceeded.  RFC8504 specifies how an IPv6 whereas DPLPMTUD does not reply upon these messages, but still can optionally use these to improve performance Section 4.6 of DPLPMTUD. <del> Since a network cannot know in advance which discovery method a QUIC endpoint is using, it should always send a PTB message in addition to dropping the oversized packet.  A generated PTB message should be </del>  compliant with the validation requirements of Section 14.2.1 of QUIC- <del> TRANSPORT, otherwise it will be ignored by DPLPMTUD.  This will likely provide the right signal for the endpoint to keep the packet size small and thereby avoid network fragmentation for that flow entirely. </del>  5.

Address ; Clarify what RFC8201 specifies; Consistently using "network segment"; Moved the IP cache discussion to end of section and adds .
Some networks support 1500-byte packets, but can only do so by fragmenting at a lower layer before traversing a smaller MTU segment,” change segment to “network segment” or “link” - just to avoid the unfortunate combination of the word“segment” often associated with TCP. I like the way the new PMTU text is heading, but have various small suggestions: This did not make sense: “For QUIC endpoints using DPLPMTUD it is recommended for the path to drop a packet larger than the supported size. A QUIC probe packet is used to discover the PMTU. If lost, this does not impact the flow of QUIC data.” the word endpoint appears in the wrong place, is this better: “For networks supporting QUIC it is recommended that a path drops any packet larger than the supported size. When a QUIC endpoint uses DPLPMTUD, it will use a QUIC probe packet is used to discover the PMTU. If this probe is lost, it will not impact the flow of QUIC data.” Not always (there are many exceptions such as rate control): “Since a network cannot know in advance which discovery method a QUIC endpoint is using, it should always send a PTB message in addition to dropping the oversized packet. “ Is this more correct as: “A network cannot know in advance which discovery method is used by a QUIC endpoint, so it should send a PTB message in addition to dropping an oversized packet. “ “This will likely provide the right signal for the endpoint to keep the packet size small and thereby avoid network fragmentation for that flow entirely.” Could be better as: “This will likely provide a useful signal to the endpoint to prevent the packet size from growing too large and thereby entirely avoid network segment fragmentation for that flow.”
Lots of points in there! Taking them one at a time: I agree that the word "segment" could be confusing, but not sure whether "link" or "network segment" is a better choice. Agree it's not particularly ideal to have "endpoint" at the beginning of the sentence. Your replacement is more readable, although we just need to remove the repetition of the verb "use". Your "A network cannot know" version looks better to me, but since the aim here is to encourage a complete implementation I would prefer to keep the word "always" in there. Without it, it seems too easy for an implementer to think "PTB is optional, so I'll skip that". Not so convinced about this one. I tend to think it is the right signal, not just one of a bag of useful signals.
Thanks, see below: Link is the correct term, wrt IP. Although "network segment" would be OK and I suspect easier to read, the word segment on its own was confusing. OK, indeed the spurious "used" needs deleted. The word "always" is a problem. Even if a node were to send a PTB message for each packet, ICMP is often rate-limited and can be filtered, and assumes a symetric forwarding path. The "should" is OK, but the always isn't a strict requirement. I think we differ on optimisim that PMTUD is still workable. However, would it be OK just to remove /useful/ and leave it as a signal. I'd be OK to also remove "likely", if that seems stronger.
Some responses on the latter two: I think Mirja had an opinion on this phrasing when we were discussing so it would be good to hear her thoughts. I agree PMTUD is on its way to obsolescence. But my reading of DPLPMTUD/RFC8899 is that it is still generally expected that PTBs are sent, hence the inclusion of section 4.6 on what to do when PTBs are received, and why totally ignoring PTBs is described as one extreme of the implementation spectrum. In that light, I suggest the best form of words is to remove both "likely" and "useful". The resulting sentence is then: “This will provide a signal to the endpoint to prevent the packet size from growing too large and thereby entirely avoid network segment fragmentation for that flow.”
Thanks NAME and NAME I will review the PR!
So Section 4.10 in manageability-11 "Guiding Path MTU" discusses dropping QUIC packets above a configured limits that are less than the normal PMTU and also sending an ICMP PTB message back when doing this. I think the text in this section would benefit from an additional clarification that implementing this can impact all IP traffic to and from the involved endpoint pairs. The reasons for this is that RFC 8201 recommend that endpoints that receive IPv6 ICMPv6 PTBs cache these messages in relation to a implementation specific representation of the path. Thus, any IPv6 packets sent from the endpoint towards a destination which the implementation considers being the same path will have a PMTU applied according to the value in the PTB. For example if you have an endpoint in an access network and a datacenter front-end that fronts both HTTP/3 servers and a DNS service that the endpoint uses, then the DNS message size would be fragmented to the lower value than the absolute PMTU. I don't see any major issue with this, but I think the document should be clear on the potential implications of applying this method to QUIC flows.
Yes if a node updates it's IP cache (which is a valid approach), this impacts other flows sharing the same "path" where the notion of path needs thought (RFC8201, s5.2). I'm noting that RFC8899 explicity says: "The PMTU value calculated from the PLPMTU MAY also be stored with the corresponding entry associated with the destination in the IP layer cache and used by other PL instances." This was a MAY because of the potential impact on other flows. When the IPv6 RFC was updated, we added some caution about ECMP, etc. which is a hint at the same problem.
I can review this.

4.10.  <ins> Some network segments support 1500-byte packets, but can only do so by fragmenting at a lower layer before traversing a network segment with a smaller MTU, and then reassembling within the network segment. This is permissible even when the IP layer is IPv6 or IPv4 with the DF bit set, because fragmention occurs below the IP layer.  However, this process can add to compute and memory costs, leading to a bottleneck that limits network capacity.  In such networks this generates a desire to influence a majority of senders to use smaller packets, to avoid exceeding limited reassembly capacity. </ins> For TCP, MSS clamping (Section 3.2 of RFC4459) is often used to  <ins> change the sender's TCP maximum segment size, but QUIC requires a </ins> different approach.  Section 14 of QUIC-TRANSPORT advises senders to probe larger sizes using Datagram Packetization Layer PMTU Discovery (DPLPMTUD) or Path Maximum Transmission Unit Discovery (PMTUD:  <ins> RFC1191 and RFC8201).  This mechanism encourages senders to approach the maximum packet size, which could then cause fragmentation within a network segment of which they may not be aware. </ins>  <ins> If path performance is limited when forwarding larger packets, an on- </ins> path device should support a maximum packet size for a specific transport flow and then consistently drop all packets that exceed the configured size when the inner IPv4 packet has DF set, or IPv6 is  <ins> used. </ins> Networks with configurations that would lead to fragmentation of  <ins> large packets within a network segment should drop such packets rather than fragmenting them.  Network operators who plan to implement a more selective policy may start by focusing on QUIC. QUIC flows cannot always be easily distinguished from other UDP traffic, but we assume at least some portion of QUIC traffic can be identified (see sec-identifying).  For networks supporting QUIC, it is recommended that a path drops any packet larger than the fragmentation size.  When a QUIC endpoint uses DPLPMTUD, it will use a QUIC probe packet to discover the PMTU.  If this probe is lost, it will not impact the flow of QUIC data. </ins> IPv4 routers generate an ICMP message when a packet is dropped because the link MTU was exceeded.  RFC8504 specifies how an IPv6 whereas DPLPMTUD does not reply upon these messages, but still can optionally use these to improve performance Section 4.6 of DPLPMTUD.  <ins> A network cannot know in advance which discovery method is used by a QUIC endpoint, so it should send a PTB message in addition to dropping an oversized packet.  A generated PTB message should be </ins> compliant with the validation requirements of Section 14.2.1 of QUIC-  <ins> TRANSPORT, otherwise it will be ignored for PMTU discovery.  This provides a signal to the endpoint to prevent the packet size from growing too large, which can entirely avoid network segment fragmentation for that flow. Endpoints can cache PMTU information, in the IP-layer cache.  This short-term consistency between the PMTU for flows can help avoid an endpoint using a PMTU that is inefficient.  The IP cache can also influence the PMTU value of other IP flows that use the same path RFC8899, including IP packets carrying protocols other than QUIC. The representation of an IP path is implementation-specific RFC8201. </ins> 5.


Some deployed in-network functions distinguish pure-acknowledgment (ACK) packets from packets carrying upper-layer data in order to attempt to enhance performance, for example by queueing ACKs <del> differently or manipulating ACK signaling.  Distinguishing ACK packets is trivial in TCP, but not supported by QUIC, since </del>  acknowledgment signaling is carried inside QUIC's encrypted payload, and ACK manipulation is impossible.  Specifically, heuristics attempting to distinguish ACK-only packets from payload-carrying

Add ref to RFC3449 rather than explain how this works.
The text says: “Distinguishing ACK packets is trivial in TCP,” arguably this is not trivial, since you need to handle data and ACKs and exclude implications of TCP options. I’d prefer to say “possible” than “trivial”.
It's more than possible, it's easy. I don't quite follow which TCP options you're referring to. I can only think of SACK, which just reduces the number of them. Why is this not as trivial as "If only the ACK bit is set, and there's no payload, it's an ACK." ? (Yes, truly bidirectional flows will have payload, but then I would argue they are not simple ACK packets.)
SACK adds an obvious widley deployed complication for TCP; ECN feedback also; some methods have simply used packet size. I know there are various forms ACK decimation/filtering/etc, some even delve into IP encaps to do this, I just don't want to convey a message that this "trivial" to get a good solution. The key point is that QUIC does not allow any of this without keying information.
I see. So we need a word that says it's a bit more complex than "trivial", but still reasonably simple (esp. in comparison with QUIC). "Possible" would work.
Yes, "possible" is indeed fine. Shall I make a PR? Gorry
I'd say yes.

Some deployed in-network functions distinguish pure-acknowledgment (ACK) packets from packets carrying upper-layer data in order to attempt to enhance performance, for example by queueing ACKs  <ins> differently or manipulating ACK signaling RFC3449.  Distinguishing ACK packets is possible in TCP, but is not supported by QUIC, since </ins> acknowledgment signaling is carried inside QUIC's encrypted payload, and ACK manipulation is impossible.  Specifically, heuristics attempting to distinguish ACK-only packets from payload-carrying


Further, if UDP traffic is desired to be throttled, it is recommended to block individual QUIC flows entirely rather than dropping packets <del> randomly.  When the handshake is blocked, QUIC-capable applications may failover to TCP However, blocking a random fraction of QUIC packets across 4-tuples will allow many QUIC handshakes to complete, preventing a TCP failover, but the connections will suffer from severe packet loss (see also sec-filtering).  Therefore UDP throttling should be realized by per-flow policing as opposed to per- packet policing.  Note that this per-flow policing should be stateless to avoid problems with stateful treatment of QUIC flows (see sec-stateful), for example blocking a portion of the space of values of a hash function over the addresses and ports in the UDP </del>  datagram.  While QUIC endpoints are often able to survive address changes, e.g. by NAT rebindings, blocking a portion of the traffic based on 5-tuple hashing increases the risk of black-holing an active

NiT Fix 365 - The randomness described was a result of indiscriminate drops.

Further, if UDP traffic is desired to be throttled, it is recommended to block individual QUIC flows entirely rather than dropping packets  <ins> indiscriminately.  When the handshake is blocked, QUIC-capable applications may failover to TCP However, blocking a random fraction of QUIC packets across 4-tuples will allow many QUIC handshakes to complete, preventing a TCP failover, but resulting in connections then suffering severe packet loss (see also sec-filtering). Therefore UDP throttling should be realized by per-flow policing, as opposed to per-packet policing.  Note that this per-flow policing should be stateless to avoid problems with stateful treatment of QUIC flows (see sec-stateful), for example blocking a portion of the space of values of a hash function over the addresses and ports in the UDP </ins> datagram.  While QUIC endpoints are often able to survive address changes, e.g. by NAT rebindings, blocking a portion of the traffic based on 5-tuple hashing increases the risk of black-holing an active


Server Hello message is obfuscated using the Initial secret. The Client Completion datagram does not expose any additional <del> information; however, recognizing it can be used to determine that a </del>  handshake has completed (see sec-confirm), and for three-way handshake RTT estimation as in sec-rtt.

this addresses a comment from NAME in issue
In the interests of timely completion of the document, will go ahead and merge this; please open an issue if this doesn't work for you NAME :)
... doesn't make it clear that only the Initial from the client (and only those sent before receiving packets from the server) contain a Destination Connection ID field that can be used to decrypt the packet. Any initial from the server, or any initial sent by a client after receiving Initial packets from the server, probably won't work.
Hmm, this is the last paragraph. Too late?
More broadly, it would be nice if Sec 2.4 discussed the property that the server CID changes pretty much immediately. We wouldn't want people to bind to a 2-tuple of CIDs and have that immediately fail.
NAME I create PR based on your comment. Is that sufficient? NAME which section are you talking about?
I think will fix NAME comment here.

Server Hello message is obfuscated using the Initial secret. The Client Completion datagram does not expose any additional  <ins> information; however, as the destination connection ID is server- selected, it usually is not the same ID than in the Client Initial datagram.  Client Completion datagram can be used to determine that a </ins> handshake has completed (see sec-confirm), and for three-way handshake RTT estimation as in sec-rtt.


cannot be used to identify QUIC as a protocol or to infer the behavior of future versions of QUIC. <del> sec-google-version provides non-normative guidance on the identification of QUIC version 1 packets compared to some pre- standard versions. </del> 2.1. QUIC packets may have either a long header or a short header.  The Note that proprietary QUIC versions, that have been deployed before standardization, might not set the first bit in a QUIC long header <del> packet to 1.  To parse these versions, example code is provided in the appendix (see sec-google-version).  However, it is expected that these versions will gradually disappear over time. </del>  When the version has been identified as QUIC version 1, the packet type needs to be verified as an Initial packet by checking that the integer as specified in Section 16 of QUIC-TRANSPORT. After decryption, the client's Initial packet can be parsed to detect <del> the CRYPTO frame that contains the TLS ClientHello, which then can be parsed similarly to TLS over TCP connections.  The client's Initial packet may contain other frames, so the first bytes of each frame need to be checked to identify the frame type, and if needed skip over it.  Note that the length of the frames is dependent on the </del>  frame type.  In QUIC version 1, the packet is expected to contain only CRYPTO frames and optionally PADDING frames.  PADDING frames, each consisting of a single zero byte, may occur before, after, or

The mentions . This makes the assumption that INITIAL packets carry a single CRYPTO frame. That assumption might not always hold in modern browsers, so the text should clarify that any middlebox that wishes to extract the SNI MUST perform reconstruction of the crypto stream from one or more CRYPTO frames in one or more INITIAL packets. The current assumption might lead middlebox vendors to write deploy software that doesn't work if there are multiple CRYPTO frames. The section correctly states but that comes late in the section and doesn't detail what middlebox vendors should do about it. That section also contains another incorrect assumption: . There are other frame types that are legal in INITIAL packets and may be sent by browsers.
I think this is pretty similar to , though that one is a bit more broad. Thanks for noticing the statement about Initials only containing CRYPTO and PADDING, I missed that.
The text already says the following now: Not sure when exactly this got added but I assume this is sufficient to address this issue? NAME NAME ?
I don't think the new text fully addresses this issue. In the new text, this statement is incorrect: What about PING frames for example? Additionally, the client's first flight won't contain extension frames because the client has no way of knowing whether the server supports them so this statement is somewhat misleading: What are middleboxes supposed to do if they see an unknown frame type, we should provide guidance there. I think we should just tell middlebox implementors to refer to that section of RFC 9000 and expect to parse all frame types, and fail parsing if they see a frame type they don't recognize. And while we're at it, we should also mention that CRYPTO frames might be out of order.
I would expect ping frame in the initial... so that sentence might still be fine. I think there could actually be extension frame in the first flight, e.g. if information was cached about the support of the extension. In any case, can you maybe propose text NAME ?
Extension caching doesn't work for initials because the server can still reject 0-RTT at this point. How about this text:
was copy-pasted from and is no longer correct. In particular it assumes that the packet only contains PADDING frames and a single CRYPTO frame with offset 0. That assumption is not guaranteed to hold with modern browsers, so this text will do more harm than good when it becomes an immutable RFC. Since we also have , I'd suggest removing Appendix A entirely.
By the time this document is published, old(ie: Q043) versions of gQUIC that aren't compatible with the IETF QUIC invariants should be gone from the internet or very close, so I'd suggest removing any text specific to it. URL It's possible some new text on distinguishing IETF QUIC version 1 is still useful, since two sections reference this appendix.

cannot be used to identify QUIC as a protocol or to infer the behavior of future versions of QUIC.  2.1. QUIC packets may have either a long header or a short header.  The Note that proprietary QUIC versions, that have been deployed before standardization, might not set the first bit in a QUIC long header  <ins> packet to 1.  However, it is expected that these versions will gradually disappear over time. </ins> When the version has been identified as QUIC version 1, the packet type needs to be verified as an Initial packet by checking that the integer as specified in Section 16 of QUIC-TRANSPORT. After decryption, the client's Initial packet can be parsed to detect  <ins> the CRYPTO frame(s) that contains the TLS ClientHello, which then can be parsed similarly to TLS over TCP connections.  The client's Initial packet may contain other frames, so the first bytes of each frame need to be checked to identify the frame type, and if needed skip over it.  Note that the length of the frames is dependent on the </ins> frame type.  In QUIC version 1, the packet is expected to contain only CRYPTO frames and optionally PADDING frames.  PADDING frames, each consisting of a single zero byte, may occur before, after, or


When the version has been identified as QUIC version 1, the packet type needs to be verified as an Initial packet by checking that the third and fourth bits of the header are both set to 0.  Then the <del> Destination Connection ID needs to be extracted to calculate the Initial secret using the version-specific Initial salt, as described in Section 5.2 of QUIC-TLS.  The length of the connection ID is indicated in the 6th byte of the header followed by the connection ID itself. </del>  To determine the end of the header and find the start of the payload, the packet number length, the source connection ID length, and the Finally, an extension might define additional frame types which could be present. <del> Note that subsequent Initial packets might contain a Destination Connection ID other than the one used to generate the Initial secret. Therefore, attempts to decrypt these packets using the procedure above might fail unless the Initial secret is retained by the observer. </del> 3.5. The QUIC connection ID (see rebinding) is designed to allow a

Addresses
... doesn't make it clear that only the Initial from the client (and only those sent before receiving packets from the server) contain a Destination Connection ID field that can be used to decrypt the packet. Any initial from the server, or any initial sent by a client after receiving Initial packets from the server, probably won't work.
Hmm, this is the last paragraph. Too late?
More broadly, it would be nice if Sec 2.4 discussed the property that the server CID changes pretty much immediately. We wouldn't want people to bind to a 2-tuple of CIDs and have that immediately fail.
NAME I create PR based on your comment. Is that sufficient? NAME which section are you talking about?
I think will fix NAME comment here.
Much better. My comment here is mostly a nit. I think that you are implicitly talking about the first packet from the client, so maybe you can avoid using the "Client Initial" thing here (if you are using the abstract concept you introduced), "client Initial" (that is, Initial packets sent by a client), or anything that might be confusing.

When the version has been identified as QUIC version 1, the packet type needs to be verified as an Initial packet by checking that the third and fourth bits of the header are both set to 0.  Then the  <ins> Destination Connection ID needs to be extracted from the packet.  The Initial secret is calculated using the version-specific Initial salt, as described in Section 5.2 of QUIC-TLS.  The length of the connection ID is indicated in the 6th byte of the header followed by the connection ID itself. Note that subsequent Initial packets might contain a Destination Connection ID other than the one used to generate the Initial secret. Therefore, attempts to decrypt these packets using the procedure above might fail unless the Initial secret is retained by the observer. </ins> To determine the end of the header and find the start of the payload, the packet number length, the source connection ID length, and the Finally, an extension might define additional frame types which could be present.  3.5. The QUIC connection ID (see rebinding) is designed to allow a


An application that implements fallback needs to consider the security consequences.  A fallback to TCP and TLS exposes control <del> information to modification and manipulation in the network.  Further downgrades to older TLS versions than 1.3, which is used in QUIC version 1, might result in significantly weaker cryptographic </del>  protection.  For example, the results of protocol negotiation RFC7301 only have confidentiality protection if TLS 1.3 is used. will generally establish state for UDP flows on the first packet sent, and keep state for much shorter idle periods than for TCP. RFC5382 suggests a TCP idle period of at least 124 minutes, though <del> there is not evidence of widespread implementation of this guideline </del>  in the literature.  Short network timeout for UDP, however, is well- documented.  According to a 2010 study (Hatonen10), UDP applications can assume that any NAT binding or other state entry can expire after 4.1. Streams are meaningful only to the application; since stream <del> information is carried inside QUIC's encryption boundary, no information about the stream(s) whose frames are carried by a given packet is visible to the network.  Therefore stream multiplexing is not intended to be used for differentiating streams in terms of network treatment.  Application traffic requiring different network treatment should therefore be carried over different five-tuples (i.e.  multiple QUIC connections).  Given QUIC's ability to send application data in the first RTT of a connection (if a previous connection to the same host has been successfully established to provide the necessary credentials), the cost of establishing another connection is extremely low. </del>  4.2. point.  HTTP/3 provides such a mechanism using the GOAWAY frame.  In HTTP/3, when the GOAWAY frame is received by a client, it stops opening new streams even if the cumulative stream limit would allow. <del> Instead the client would create a new connection on which to open </del>  further streams.  Once all streams are closed on the old connection, it can be terminated safely by a connection close or after expiration of the idle time out (see also sec-termination). If the application requires low latency, with only small chunks of data to send, it may be valuable to indicate to QUIC that all data <del> should be send out immediately.  Alternatively, if the application </del>  expects to use a specific sending pattern, it can also provide a suggested delay to QUIC for how long to wait before bundle frames into a packet. Path validation is required so that endpoints validate paths before use to avoid address spoofing attacks.  Path validation takes at least one RTT and congestion control will also be reset after path <del> migration.  Therefore migration usually has a performance impact. </del>  QUIC probing packets, which can be sent on multiple paths at once, are used to perform address validation as well as measure path likely contain padding frames.  Endpoints can use information about their receipt as input to congestion control for that path. Applications could use information learned from probing to inform a <del> decisions to switch paths. </del>  Only the client can actively migrate in version 1 of QUIC.  However, servers can indicate during the handshake that they prefer to the same 5-tuple {dest addr, source addr, protocol, dest port, source port}, will receive similar network treatment since feedback about loss or delay of each packet is used as input to the congestion <del> controller.  Therefore it is not recommended to use different </del>  DiffServ Code Points (DSCPs) RFC2475 for packets belonging to the same connection.  If differential network treatment, e.g. by the use of different DSCPs, is desired, multiple QUIC connections to the same ambiguity when validating the negotiated version. The second stage of deployment commences once all server instances <del> are able accept new connections with the new version.  At this point, all servers can start sending the new version in Version Negotiation packets. </del>  During the second stage, the server still allows for the possibility that some clients believe the new version to be available and some do be dropped if the receiver is overloaded.  While the reliable transmission service of QUIC provides a stream-based interface to send and receive data in order over multiple QUIC streams, the <del> datagram service has a unordered message-based interface.  If needed, an application layer framing can be used on top to allow separate flows of unreliable datagrams to be multiplexed on one QUIC </del>  connection. 16.

All comments below are about very minor potential issues that you may choose to address in some way - or ignore - as you see fit. Some were flagged by automated tools (via URL), so there will likely be some false positives. There is no need to let me know what you did with these suggestions.

An application that implements fallback needs to consider the security consequences.  A fallback to TCP and TLS exposes control  <ins> information to modification and manipulation in the network. Further, downgrades to older TLS versions than 1.3, which is used in QUIC version 1, might result in significantly weaker cryptographic </ins> protection.  For example, the results of protocol negotiation RFC7301 only have confidentiality protection if TLS 1.3 is used. will generally establish state for UDP flows on the first packet sent, and keep state for much shorter idle periods than for TCP. RFC5382 suggests a TCP idle period of at least 124 minutes, though  <ins> there is no evidence of widespread implementation of this guideline </ins> in the literature.  Short network timeout for UDP, however, is well- documented.  According to a 2010 study (Hatonen10), UDP applications can assume that any NAT binding or other state entry can expire after 4.1. Streams are meaningful only to the application; since stream  <ins> information is carried inside QUIC's encryption boundary, a given packet exposes no information about which stream(s) are carried within the packet.  Therefore, stream multiplexing is not intended to be used for differentiating streams in terms of network treatment. Application traffic requiring different network treatment should therefore be carried over different five-tuples (i.e.  multiple QUIC connections).  Given QUIC's ability to send application data in the first RTT of a connection (if a previous connection to the same host has been successfully established to provide the necessary credentials), the cost of establishing another connection is extremely low. </ins> 4.2. point.  HTTP/3 provides such a mechanism using the GOAWAY frame.  In HTTP/3, when the GOAWAY frame is received by a client, it stops opening new streams even if the cumulative stream limit would allow.  <ins> Instead, the client would create a new connection on which to open </ins> further streams.  Once all streams are closed on the old connection, it can be terminated safely by a connection close or after expiration of the idle time out (see also sec-termination). If the application requires low latency, with only small chunks of data to send, it may be valuable to indicate to QUIC that all data  <ins> should be sent out immediately.  Alternatively, if the application </ins> expects to use a specific sending pattern, it can also provide a suggested delay to QUIC for how long to wait before bundle frames into a packet. Path validation is required so that endpoints validate paths before use to avoid address spoofing attacks.  Path validation takes at least one RTT and congestion control will also be reset after path  <ins> migration.  Therefore, migration usually has a performance impact. </ins> QUIC probing packets, which can be sent on multiple paths at once, are used to perform address validation as well as measure path likely contain padding frames.  Endpoints can use information about their receipt as input to congestion control for that path. Applications could use information learned from probing to inform a  <ins> decision to switch paths. </ins> Only the client can actively migrate in version 1 of QUIC.  However, servers can indicate during the handshake that they prefer to the same 5-tuple {dest addr, source addr, protocol, dest port, source port}, will receive similar network treatment since feedback about loss or delay of each packet is used as input to the congestion  <ins> controller.  Therefore, it is not recommended to use different </ins> DiffServ Code Points (DSCPs) RFC2475 for packets belonging to the same connection.  If differential network treatment, e.g. by the use of different DSCPs, is desired, multiple QUIC connections to the same ambiguity when validating the negotiated version. The second stage of deployment commences once all server instances  <ins> are able to accept new connections with the new version.  At this point, all servers can start sending the new version in Version Negotiation packets. </ins> During the second stage, the server still allows for the possibility that some clients believe the new version to be available and some do be dropped if the receiver is overloaded.  While the reliable transmission service of QUIC provides a stream-based interface to send and receive data in order over multiple QUIC streams, the  <ins> datagram service has an unordered message-based interface.  If needed, an application layer framing can be used on top to allow separate flows of unreliable datagrams to be multiplexed on one QUIC </ins> connection. 16.


3.8. <del> The round-trip time of QUIC flows can be inferred by observation once per flow, during the handshake, as in passive TCP measurement; this requires parsing of the QUIC packet header and recognition of the handshake, as illustrated in handshake.  It can also be inferred during the flow's lifetime, if the endpoints use the spin bit facility described below and in Section 17.3.1 of QUIC-TRANSPORT. </del>  3.8.1. on each packet sent. When in use, the latency spin bit in each direction changes value <del> once per round-trip time (RTT) any time that both endpoints are sending packets continuously.  An on-path observer can observe the time difference between edges (changes from 1 to 0 or 0 to 1) in the spin bit signal in a single direction to measure one sample of end- to-end RTT.  This mechanism follows the principles of protocol measurability laid out in IPIM. </del>  Note that this measurement, as with passive RTT measurement for TCP, includes any transport protocol delay (e.g., delayed sending of Limited RTT measurement is possible by passive observation of QUIC traffic; see sec-rtt.  No passive measurement of loss is possible <del> with the present wire image.  Extremely limited observation of upstream congestion may be possible via the observation of CE markings on ECN-enabled QUIC traffic. </del>  4.2.

Refers to quicwg. This also addresses /extremely limited/ ECN visibility (limited for sure, but we don't need to say "extremely"). Fixed multiple definitions of RTT Refered to metrics, etc for encrypted traffic wrt network-layer measurement via a REF.
Thanks for the suggestions from Ian and Mirjay, they were of course incorporated.

3.8.  <ins> The round-trip time (RTT) of QUIC flows can be inferred by observation once per flow, during the handshake, as in passive TCP measurement; this requires parsing of the QUIC packet header and recognition of the handshake, as illustrated in handshake.  It can also be inferred during the flow's lifetime, if the endpoints use the spin bit facility described below and in Section 17.3.1 of QUIC- TRANSPORT. </ins> 3.8.1. on each packet sent. When in use, the latency spin bit in each direction changes value  <ins> once per RTT any time that both endpoints are sending packets continuously.  An on-path observer can observe the time difference between edges (changes from 1 to 0 or 0 to 1) in the spin bit signal in a single direction to measure one sample of end-to-end RTT.  This mechanism follows the principles of protocol measurability laid out in IPIM. </ins> Note that this measurement, as with passive RTT measurement for TCP, includes any transport protocol delay (e.g., delayed sending of Limited RTT measurement is possible by passive observation of QUIC traffic; see sec-rtt.  No passive measurement of loss is possible  <ins> with the present wire image.  Limited observation of upstream congestion may be possible via the observation of CE markings on ECN- enabled QUIC traffic. On-path devices can also make measurements of RTT, loss and other performance metrics when information is carried in an additional network-layer packet header (Section 6 of I-D.ietf-tsvwg-transport- encrypt describes use of operations, administration and management (OAM) information).  Using network-layer approaches also has the advantage that common observation and analysis tools can be consistently used by multiple transport protocols, however, these techniques are often limited to measurements within one or multiple cooperating domains. </ins> 4.2.


7. <del> The cost of sending acknowledgments - in processing cost or link utilization - could be a significant proportion of available resources if these resources are constrained.  Reducing the rate at which acknowledgments are generated can preserve these resources and improve overall performance, for both network processing as well as application-relevant metrics. </del>  8.

There is text in the transport document on reducing ACK frequency. I think that that is sufficient. As this is more about performance tuning for implementers of the QUIC transport itself, it might be best to remove this section.
I am going to argue aganist this. It's a valid operational concern for a current network operator (at least any operator that does radio capacity assignment) and an apps developer. Although QUIC ACKs are something an endpoint might/ought to optimise, it was not really resolved in the core spec. QUIC can be more greedy on return capacity than TCP practically would when on-path mitigations are used.
This section was added based on comments from previous last call. I wouldn't want to remove it based on only one comment here. If more discussion is needed, we can bring it to the list.
I might agree with Martin. The document states "... Its intended audience is designers of application protocol mappings to QUIC, and implementors of these application protocols", and arguably the concerns about ACK frequency are not the concerns of the target audience. What can an application layer person do about this realistically? I don't think we they can change the app protocol design around this transport behaviour. That's not to say that the advice is bad. But I think the section would be stronger if it said plainly the caveat that Gorry just mentioned - applications using QUIC may find that the return traffic is more verbose than TCP, due to the differences in ACK generation and optimizations that have been applied.
I have mixed feelings on this, but I think there may be some things worth saying that are applicable to this audience. I think we need to change the existing text to clearly state that applications using QUIC may find that ACKs consume more resources, and cite transport if possible. Additionally, I think it's worth calling out that the ACK policy of QUIC v1 (without something like ACK-frequency) is designed to be similar to TCP, and may not be optimal for the full set of applications that QUIC can support. Realtime/WebRTC as well as VPN applications come to mind.
NAME there is also a section on ACK traffic in the manageability statement:
NAME NAME can anybody propose a PR? However, I think this would be a PR against the section on ACK traffic in the manageability statement if the intended audience is network operators.
For the applicability statement I created PR providing some more explanations. Does that help or do people still prefer to drop/move more considerations to the manageability statement? NAME NAME NAME NAME
Thanks for the PR, I think it's heading in a fairly good direction. But if people want to remove it from this draft, I'm not going to stand in your way.
This seems like it is in the right direction. I don't like how much text it adds though.For me, I think we are now so close ... I'd kind of like to see two paras, since these are two concepts, and it would be great to see both paras in the same section.

7.  <ins> QUIC version 1 without extensions uses an acknowledgment strategy adopted from TCP.  That is, every other packet is acknowledged. However, generating and processing QUIC acknowledgments can consume significant resources, both in terms of processing costs and link utilization, especially on constraint networks.  Some applications might be able to improve overall performance by using alternative strategies that reduce the rate of acknowledgments. </ins> 8.


visible in the UDP datagrams containing the QUIC handshake, then examine each of the datagrams in detail. <del> The QUIC handshake can normally be recognized on the wire through at least four datagrams labelled "Client Initial", "Server Initial", and "Client Completion", and "Server Completion", in the illustration shown in fig-handshake. </del>  Packets in the handshake belong to three separate cryptographic and transport contexts ("Initial", which contains observable payload, and "Handshake" and "1-RTT", which do not).  QUIC packets in separate <del> contexts during the handshake are generally coalesced (see coalesced) in order to reduce the number of UDP datagrams sent during the handshake. </del>  As shown here, the client can send 0-RTT data as soon as it has sent its Client Hello, and the server can send 1-RTT data as soon as it has sent its Server Hello. <del> A typical handshake starts with the client sending of a Client Initial datagram as shown in fig-client-initial, which elicits a Server Initial datagram as shown in fig-server-initial typically containing three packets: an Initial packet with the beginning of the server's side of the TLS handshake, a Handshake packet with the rest of the server's side of the TLS handshake, and 1-RTT data, if present. </del>  <del> The Client Completion datagram contains at least one Handshake packet </del>  and could also include an Initial packet. Datagrams that contain an Initial packet (Client Initial, Server The content of Initial packets is encrypted using Initial Secrets, which are derived from a per-version constant and the client's destination connection ID; they are therefore observable by any on- <del> path device that knows the per-version constant.  They are therefore considered visible in this illustration.  The content of QUIC Handshake packets are encrypted using keys established during the initial handshake exchange, and are therefore not visible. Initial, Handshake, and the 1-RTT packets transmitted after the handshake belong to cryptographic and transport contexts.  The Client Completion fig-init-complete and the Server Completion fig-hs- complete datagrams finish these first two contexts, by sending the final acknowledgment and finishing the transmission of CRYPTO frames. The Client Initial datagram exposes version number, source and destination connection IDs without encryption.  Information in the TLS Client Hello frame, including any TLS Server Name Indication (SNI) present, is obfuscated using the Initial secret.  Note that the location of PADDING is implementation-dependent, and PADDING frames might not appear in a coalesced Initial packet. </del>  The Server Initial datagram also exposes version number, source and <del> destination connection IDs in the clear; information in the TLS Server Hello message is obfuscated using the Initial secret. </del>  <del> The Client Completion datagram does not expose any additional </del>  information; however, as the destination connection ID is server- <del> selected, it usually is not the same ID than in the Client Initial datagram.  Client Completion datagram can be used to determine that a handshake has completed (see sec-confirm), and for three-way handshake RTT estimation as in sec-rtt. </del>  Similar to Client Completion, Server Completion also exposes no additional information; observing it serves only to determine that the handshake has completed. When the client uses 0-RTT connection resumption, the Client Initial <del> datagram can also carry 0-RTT data, as shown in fig-client-initial- 0rtt. In a 0-RTT Client Initial datagram, the PADDING frame is only present if necessary to increase the size of the datagram with 0-RTT data to at least 1200 bytes.  Additional datagrams containing only 0-RTT packets with long headers could be sent from the client to the server after the Client Initial datagram, containing the rest of the 0-RTT data.  The amount of 0-RTT protected data that can be sent in the first flight is limited by the initial congestion window, typically to around 10 packets (see Section 7.2 of QUIC-RECOVERY). </del>  2.5.

As noted in the "The QUIC Handshake" is written in a way that could cause readers to assume things such as there's only one datagram containing a Client Initial. This PR changes the naming from 'Client/Server Initial/Finished datagram' to 'Client/Server Initial/Finished flight' and makes related changes to make it read correctly. The diagrams have not been fully updated yet.
QUIC handshakes may or may not coalesce packets, which is stated, but I'm worried it could be missed by a reader. I think it'd be good to clarify that any portion of the server or client flight could span multiple datagrams. In particular, I'm worried this paragraph could mislead people, because unless the connection is resumed, the Handshake CRYPTO data typically spans multiple datagrams. Similarly, the client or server's Initial can span multiple datagrams, though that's not currently common:
I think some clarity about multiple packets/datagrams would be helpful in the Extracting SNI section as well: URL Specifically: 1) Client initial data can span multiple datagrams, and the SNI could be in any of them. 2) A single client Initial packet can contain multiple CRYPTO frames, and there's no strict requirement they're in order of offset.
NAME can you maybe propose a PR? :-)
Yes, possibly later today after I finish reviewing the draft.
NAME are you still planning to do a PR here?
I will unless someone beats me to it, but I've been on paternity leave for 10 days. NAME had some suggested text for the SNI section, but I can try to fix "The QUIC Handshake" and assume David's text is a good start for SNI.
While writing the PR, I discovered a problem I'm not sure how to fix, which is how does an observer know when the handshake is complete for the server, given the server can start using 1-RTT keys immediately after receiving the client hello? Receipt of the client's 1-RTT packet doesn't guarantee anything, because the server can't process it if it doesn't have keys.
lgtm, one potential diagram nit.

visible in the UDP datagrams containing the QUIC handshake, then examine each of the datagrams in detail.  <ins> The QUIC handshake can normally be recognized on the wire through four flights of datagrams labelled "Client Initial", "Server Initial", "Client Completion", and "Server Completion", in the illustration shown in fig-handshake. </ins> Packets in the handshake belong to three separate cryptographic and transport contexts ("Initial", which contains observable payload, and "Handshake" and "1-RTT", which do not).  QUIC packets in separate  <ins> contexts during the handshake can be coalesced (see coalesced) in order to reduce the number of UDP datagrams sent during the handshake.  QUIC packets can be lost and reordered, so packets within a flight might not be sent close in time, though the sequence of the flights will not change, because one flight depends upon the peer's previous flight. </ins> As shown here, the client can send 0-RTT data as soon as it has sent its Client Hello, and the server can send 1-RTT data as soon as it has sent its Server Hello.  <ins> A handshake starts with the client sending one or more datagrams containing Initial packets as shown in fig-client-initial, which elicits the Server Initial response as shown in fig-server-initial typically containing three types of packets: Initial packet(s) with the beginning of the server's side of the TLS handshake, Handshake packet(s) with the rest of the server's portion of the TLS handshake, and 1-RTT packet(s), if present. </ins>  <ins> The Client Completion flight contains at least one Handshake packet </ins> and could also include an Initial packet. Datagrams that contain an Initial packet (Client Initial, Server The content of Initial packets is encrypted using Initial Secrets, which are derived from a per-version constant and the client's destination connection ID; they are therefore observable by any on-  <ins> path device that knows the per-version constant and considered visible in this illustration.  The content of QUIC Handshake packets are encrypted using keys established during the initial handshake exchange, and are therefore not visible. Initial, Handshake, and 1-RTT packets belong to different cryptographic and transport contexts.  The Client Completion fig- init-complete and the Server Completion fig-hs-complete flights conclude the Initial and Handshake contexts, by sending final acknowledgments and CRYPTO frames. A Client Initial packet exposes the version, source and destination connection IDs without encryption.  The payload of the Initial packet is obfuscated using the Initial secret.  The complete TLS Client Hello, including any TLS Server Name Indication (SNI) present, is sent in one or more CRYPTO frames across one or more QUIC Initial packets. </ins> The Server Initial datagram also exposes version number, source and  <ins> destination connection IDs in the clear; the payload of the Initial packet(s) is obfuscated using the Initial secret. </ins>  <ins> The Client Completion flight does not expose any additional </ins> information; however, as the destination connection ID is server-  <ins> selected, it usually is not the same ID than in the Client Initial. Client Completion flights contain 1-RTT packets which indicate the handshake has completed (see sec-confirm) on the client, and for three-way handshake RTT estimation as in sec-rtt. </ins> Similar to Client Completion, Server Completion also exposes no additional information; observing it serves only to determine that the handshake has completed. When the client uses 0-RTT connection resumption, the Client Initial  <ins> flight can also include one or more 0-RTT packets, as shown in fig- client-initial-0rtt. When a 0-RTT packet is coalesced with an Initial packet, the datagram will be padded to 1200 byes.  Additional datagrams containing only 0-RTT packets with long headers can be sent after the client Initial packet(s), containing more 0-RTT data.  The amount of 0-RTT protected data that can be sent in the first flight is limited by the initial congestion window, typically to around 10 packets (see Section 7.2 of QUIC-RECOVERY). </ins> 2.5.


If the ClientHello is not encrypted, SNI can be derived from the client's Initial packet by calculating the Initial secret to decrypt <del> the packet payload and parsing the QUIC CRYPTO Frame containing the TLS ClientHello. </del>  As both the derivation of the Initial secret and the structure of the Initial packet itself are version-specific, the first step is always After decryption, the client's Initial packet can be parsed to detect the CRYPTO frame(s) that contains the TLS ClientHello, which then can <del> be parsed similarly to TLS over TCP connections.  The client's Initial packet may contain other frames, so the first bytes of each frame need to be checked to identify the frame type, and if needed skip over it.  Note that the length of the frames is dependent on the frame type.  In QUIC version 1, the packet is expected to contain only CRYPTO frames and optionally PADDING frames.  PADDING frames, each consisting of a single zero byte, may occur before, after, or between CRYPTO frames.  There might be multiple CRYPTO frames. Finally, an extension might define additional frame types which could be present. </del>  3.5.

I think there are still a few potentially misleading statements left in the text. I'll send out a PR.
The mentions . This makes the assumption that INITIAL packets carry a single CRYPTO frame. That assumption might not always hold in modern browsers, so the text should clarify that any middlebox that wishes to extract the SNI MUST perform reconstruction of the crypto stream from one or more CRYPTO frames in one or more INITIAL packets. The current assumption might lead middlebox vendors to write deploy software that doesn't work if there are multiple CRYPTO frames. The section correctly states but that comes late in the section and doesn't detail what middlebox vendors should do about it. That section also contains another incorrect assumption: . There are other frame types that are legal in INITIAL packets and may be sent by browsers.
I think this is pretty similar to , though that one is a bit more broad. Thanks for noticing the statement about Initials only containing CRYPTO and PADDING, I missed that.
The text already says the following now: Not sure when exactly this got added but I assume this is sufficient to address this issue? NAME NAME ?
I don't think the new text fully addresses this issue. In the new text, this statement is incorrect: What about PING frames for example? Additionally, the client's first flight won't contain extension frames because the client has no way of knowing whether the server supports them so this statement is somewhat misleading: What are middleboxes supposed to do if they see an unknown frame type, we should provide guidance there. I think we should just tell middlebox implementors to refer to that section of RFC 9000 and expect to parse all frame types, and fail parsing if they see a frame type they don't recognize. And while we're at it, we should also mention that CRYPTO frames might be out of order.
I would expect ping frame in the initial... so that sentence might still be fine. I think there could actually be extension frame in the first flight, e.g. if information was cached about the support of the extension. In any case, can you maybe propose text NAME ?
Extension caching doesn't work for initials because the server can still reject 0-RTT at this point. How about this text:

If the ClientHello is not encrypted, SNI can be derived from the client's Initial packet by calculating the Initial secret to decrypt  <ins> the packet payload and parsing the QUIC CRYPTO frame(s) containing the TLS ClientHello. </ins> As both the derivation of the Initial secret and the structure of the Initial packet itself are version-specific, the first step is always After decryption, the client's Initial packet can be parsed to detect the CRYPTO frame(s) that contains the TLS ClientHello, which then can  <ins> be parsed similarly to TLS over TCP connections.  Note that there can be multiple CRYPTO frames, and they might not be in order, so reassembling the CRYPTO stream by parsing offsets and lengths is required.  Further, the client's Initial packet may contain other frames, so the first bytes of each frame need to be checked to identify the frame type, and if needed skipped over it.  Note that the length of the frames is dependent on the frame type; see Section 18 of QUIC-TRANSPORT.  E.g.  PADDING frames, each consisting of a single zero byte, may occur before, after, or between CRYPTO frames.  However, extensions might define additional frame types.  If an unknown frame type is encountered, it is impossible to know the length of that frame which prevents skipping over it, and therefore parsing fails. </ins> 3.5.


3.4.1. If the ClientHello is not encrypted, SNI can be derived from the <del> client's Initial packet by calculating the Initial secret to decrypt the packet payload and parsing the QUIC CRYPTO frame(s) containing the TLS ClientHello. </del>  As both the derivation of the Initial secret and the structure of the Initial packet itself are version-specific, the first step is always above might fail unless the Initial secret is retained by the observer. <del> To determine the end of the header and find the start of the payload, the packet number length, the source connection ID length, and the token length need to be extracted.  The packet number length is defined by the seventh and eight bits of the header as described in Section 17.2 of QUIC-TRANSPORT, but is obfuscated as described in </del>  Section 5.4 of QUIC-TLS.  The source connection ID length is specified in the byte after the destination connection ID.  The token length, which follows the source connection ID, is a variable-length integer as specified in Section 16 of QUIC-TRANSPORT. <del> After decryption, the client's Initial packet can be parsed to detect the CRYPTO frame(s) that contains the TLS ClientHello, which then can be parsed similarly to TLS over TCP connections.  Note that there can be multiple CRYPTO frames, and they might not be in order, so reassembling the CRYPTO stream by parsing offsets and lengths is required.  Further, the client's Initial packet may contain other frames, so the first bytes of each frame need to be checked to identify the frame type, and if needed skipped over it.  Note that the length of the frames is dependent on the frame type; see Section 18 of QUIC-TRANSPORT.  E.g.  PADDING frames, each consisting of a single zero byte, may occur before, after, or between CRYPTO frames.  However, extensions might define additional frame types.  If an unknown frame type is encountered, it is impossible to know the length of that frame which prevents skipping over it, and therefore parsing fails. </del>  3.5.

Follow-on to
Thanks NAME As there are clarifications/editorial, I think we will wait for the AD review and take this PR up with a next revision before or after IETF last call. But I think it's ready to merge!
You're welcome. Agreed they're editorial, so merge whenever it makes sense.

3.4.1. If the ClientHello is not encrypted, SNI can be derived from the  <ins> client's Initial packet(s) by calculating the Initial secret to decrypt the packet payload and parsing the QUIC CRYPTO frame(s) containing the TLS ClientHello. </ins> As both the derivation of the Initial secret and the structure of the Initial packet itself are version-specific, the first step is always above might fail unless the Initial secret is retained by the observer.  <ins> To determine the end of the packet header and find the start of the payload, the packet number length, the source connection ID length, and the token length need to be extracted.  The packet number length is defined by the seventh and eight bits of the header as described in Section 17.2 of QUIC-TRANSPORT, but is obfuscated as described in </ins> Section 5.4 of QUIC-TLS.  The source connection ID length is specified in the byte after the destination connection ID.  The token length, which follows the source connection ID, is a variable-length integer as specified in Section 16 of QUIC-TRANSPORT.  <ins> After decryption, the client's Initial packet(s) can be parsed to detect the CRYPTO frame(s) that contains the TLS ClientHello, which then can be parsed similarly to TLS over TCP connections.  Note that there can be multiple CRYPTO frames spread out over one or mor Initial packets, and they might not be in order, so reassembling the CRYPTO stream by parsing offsets and lengths is required.  Further, the client's Initial packet(s) may contain other frames, so the first bytes of each frame need to be checked to identify the frame type, and if needed skipped over it.  Note that the length of the frames is dependent on the frame type; see Section 18 of QUIC-TRANSPORT.  E.g. PADDING frames, each consisting of a single zero byte, may occur before, after, or between CRYPTO frames.  However, extensions might define additional frame types.  If an unknown frame type is encountered, it is impossible to know the length of that frame which prevents skipping over it, and therefore parsing fails. </ins> 3.5.


Use of a non-zero-length connection ID for the server is strongly recommended if any clients are behind a NAT or could be.  A non-zero- <del> length connection ID is also strongly recommended when migration is supported. </del>  The base specification of QUIC version 1 only supports the use of a single network path at a time, which enables failover use cases. replay attacks, and randomness discussed in QUIC-TLS should be taken into account when deploying and using QUIC.  Application developers should note that any fallback they use when QUIC cannot be used due to network blocking of UDP should guarantee the same security properties as QUIC; if this is not possible, the

This would be my proposal of a few small additions based on the discussion on list and at the last meeting (IETF-112) about privacy implications after migration regarding exposure of linkable user IP addresses to the server. The text doesn't give any recommendations but at least mentions it in the relevant sections.
I left a few suggestions, but this is heading in a good direction.

Use of a non-zero-length connection ID for the server is strongly recommended if any clients are behind a NAT or could be.  A non-zero-  <ins> length connection ID is also strongly recommended when active migration is supported.  If a connection is intentionally migrated to new path, a new connection ID is used to minimize linkability by network observers.  The other QUIC endpoint uses the connection ID to link different addresses to the same connection and entity if a non- zero-length connection ID is provided. </ins> The base specification of QUIC version 1 only supports the use of a single network path at a time, which enables failover use cases. replay attacks, and randomness discussed in QUIC-TLS should be taken into account when deploying and using QUIC. <ins> Further, migration to an new address exposes a linkage between client addresses to the server and may expose this linkage also to the path if the connection ID cannot be changed or flows can otherwise be correlated.  When migration is supported, this needs to be considered with respective to user privacy. </ins> Application developers should note that any fallback they use when QUIC cannot be used due to network blocking of UDP should guarantee the same security properties as QUIC; if this is not possible, the


Version Negotiation packets are used by the server to indicate that a requested version from the client is not supported (see Section 6 of QUIC-TRANSPORT.  Version Negotiation packets are not intrinsically <del> protected, but future QUIC versions will use later encrypted messages to verify that they were authentic.  Therefore, any modification of this list will be detected and may cause the endpoints to terminate the connection attempt. </del>  Also note that the list of versions in the Version Negotiation packet may contain reserved versions.  This mechanism is used to avoid

Currently the document uses "will". This might be a very valid assumption, but still it is an assumption hence I think it is better to use "May" instead of "Will".

Version Negotiation packets are used by the server to indicate that a requested version from the client is not supported (see Section 6 of QUIC-TRANSPORT.  Version Negotiation packets are not intrinsically  <ins> protected, but future QUIC versions could use later encrypted messages to verify that they were authentic.  Therefore, any modification of this list will be detected and may cause the endpoints to terminate the connection attempt. </ins> Also note that the list of versions in the Version Negotiation packet may contain reserved versions.  This mechanism is used to avoid


encrypt describes use of operations, administration and management (OAM) information).  Using network-layer approaches also has the advantage that common observation and analysis tools can be <del> consistently used by multiple transport protocols, however, these </del>  techniques are often limited to measurements within one or multiple cooperating domains.

well I don't think transport protocol will be using any of the tools rather those tools can be used to observer multiple protocols

encrypt describes use of operations, administration and management (OAM) information).  Using network-layer approaches also has the advantage that common observation and analysis tools can be  <ins> consistently used for multiple transport protocols, however, these </ins> techniques are often limited to measurements within one or multiple cooperating domains.


12. <del> QUIC, as defined in RFC9000, has a single congestion controller and </del>  recovery handler.  This design assumes that all packets of a QUIC connection, or at least with the same 5-tuple {dest addr, source addr, protocol, dest port, source port}, that have the same DiffServ

as well
I didn't expect any other normative reference than RFC 9000, 9001 in this document. Why are other references needed to be listed in the normative reference? The reference list also have duplicate entries (i.e. same ref named differently) this need to be fixed as well.
I added this to PR - changed TLS1.3 and RFC6335 to informative, so only RFC8999, RFC9000, and RFC9001 should bee normative now.
I noticed that there are references to QUIC I-Ds. Applicability even references both -34 and RFC9000 :smile:

12.  <ins> QUIC, as defined in QUIC, has a single congestion controller and </ins> recovery handler.  This design assumes that all packets of a QUIC connection, or at least with the same 5-tuple {dest addr, source addr, protocol, dest port, source port}, that have the same DiffServ


behavior admits a handful of UDP packets and then makes a decision to whether or not filter later packets in the same connection.  QUIC applications are encouraged to fail over to TCP if early packets do <del> not arrive at their destination I-D.ietf-quic-applicability, as QUIC is based on UDP and there are known blocks of UDP traffic (see sec- udp-1312).  Admitting a few packets allows the QUIC endpoint to determine that the path accepts QUIC.  Sudden drops afterwards will result in slow and costly timeouts before abandoning the connection. </del>  4.6. black-holing an active connection when the address changes. Note that some source ports are assumed to be reflection attack <del> vectors by some servers; see Section 8.1 of I-D.ietf-quic- applicability.  As a result, NAT binding to these source ports can result in that traffic being blocked. </del>  4.7. short-term consistency between the PMTU for flows can help avoid an endpoint using a PMTU that is inefficient.  The IP cache can also influence the PMTU value of other IP flows that use the same path <del> RFC8899, including IP packets carrying protocols other than QUIC. </del>  The representation of an IP path is implementation-specific RFC8201. 5.

as well
There are some outdated references those I goes will go away with further revisions. However, there are duplicate references those I believe need to be fixed manually. -- Duplicate reference: draft-ietf-quic-applicability, mentioned in 'QUIC-APPLICABILITY', was also mentioned in 'I-D.ietf-quic-applicability'. -- Duplicate reference: RFC8899, mentioned in 'RFC8899', was also mentioned in 'DPLPMTUD'.
I noticed that there are references to QUIC I-Ds. Applicability even references both -34 and RFC9000 :smile:

behavior admits a handful of UDP packets and then makes a decision to whether or not filter later packets in the same connection.  QUIC applications are encouraged to fail over to TCP if early packets do  <ins> not arrive at their destination QUIC-APPLICABILITY, as QUIC is based on UDP and there are known blocks of UDP traffic (see sec-udp-1312). Admitting a few packets allows the QUIC endpoint to determine that the path accepts QUIC.  Sudden drops afterwards will result in slow and costly timeouts before abandoning the connection. </ins> 4.6. black-holing an active connection when the address changes. Note that some source ports are assumed to be reflection attack  <ins> vectors by some servers; see Section 8.1 of QUIC-APPLICABILITY.  As a result, NAT binding to these source ports can result in that traffic being blocked. </ins> 4.7. short-term consistency between the PMTU for flows can help avoid an endpoint using a PMTU that is inefficient.  The IP cache can also influence the PMTU value of other IP flows that use the same path  <ins> DPLPMTUD, including IP packets carrying protocols other than QUIC. </ins> The representation of an IP path is implementation-specific RFC8201. 5.


signaling means that less information is visible to the network than is the case with TCP. <del> Integrity protection can also simplify troubleshooting, because none of the nodes on the network path can modify transport layer information.  However, it means in-network operations that depend on modification of data are not possible without the cooperation of an QUIC endpoint.  This might be possible with the introduction of a proxy which authenticates as an endpoint.  Proxy operations are not in scope for this document. </del>  Network management is not a one-size-fits-all endeavour: practices considered necessary or even mandatory within enterprise networks

URL, I am not sure I get what this paragraph is supposed to mean. Number of things - first of all it is not clear that integrity protection actually simply the troubleshooting without defining that kind of troubleshooting we are referring to here and who is doing those, even though it is true that now network nodes cannot modify the transport layer information. we are making a statement that in-network operations depends on modification of data, what is the data here? payload? header information? both? I think here we can reference to the I-D.ietf-tsvwg-transport-encrypt to setup the background information required to parse the statement correctly. I am not sure how a proxy here can support modification of data. Yes, that is my read of this last of the statement. Hence, hence we might want to clarify what is the scope of this collaboration that we are referring to .
addressed by

signaling means that less information is visible to the network than is the case with TCP.  <ins> Integrity protection can also simplify troubleshooting at the end points as none of the nodes on the network path can modify transport layer information.  However, it means in-network operations that depend on modification of data (e.g. see RFC9065 are not possible without the cooperation of an QUIC endpoint.  Such cooperation might be possible with the introduction of a proxy which authenticates as an endpoint.  Proxy operations are not in scope for this document. </ins> Network management is not a one-size-fits-all endeavour: practices considered necessary or even mandatory within enterprise networks


symmetry of a flow (whether primarily client-to-server, primarily server-to-client, or roughly bidirectional, as input to basic traffic classification techniques) can be inferred through the measurement of <del> data rate in each direction.  While QUIC traffic is protected and ACKs may be padded, padding is not required. </del>  3.8.

URL I am not sure what does the last sentence supposed to add to the context and see it is something more important for the applicability part than manageability part.
I already clarified the sentence in PR related to issue . Or is this the wrong reference?
ok, fine with me.
URL, padding and padding frames have been discussed/mentioned several times but I haven't got a clear indication on what does the padding to the manageability. Please point me to the description if I am mistaken.

symmetry of a flow (whether primarily client-to-server, primarily server-to-client, or roughly bidirectional, as input to basic traffic classification techniques) can be inferred through the measurement of  <ins> data rate in each direction.  Note that QUIC packets containing only control frames (such as ACK-only packets) may be padded.  Padding, though optional, may conceal connection roles or flow symmetry information. </ins> 3.8.


3.3. <del> Some deployed in-network functions distinguish pure-acknowledgment (ACK) packets from packets carrying upper-layer data in order to attempt to enhance performance, for example by queueing ACKs differently or manipulating ACK signaling RFC3449.  Distinguishing ACK packets is possible in TCP, but is not supported by QUIC, since acknowledgment signaling is carried inside QUIC's encrypted payload, and ACK manipulation is impossible.  Specifically, heuristics attempting to distinguish ACK-only packets from payload-carrying packets based on packet size are likely to fail, and are not recommended to use as a way to construe internals of QUIC's operation as those mechanisms can change, e.g., due to the use of extensions. </del>  3.4.

URL, what is a pure-acknowledgment (ACK) packet?

3.3.  <ins> Some deployed in-network functions distinguish packets that carry only acknowledgment (ACK-only) information from packets carrying upper-layer data in order to attempt to enhance performance, for example by queueing ACKs differently or manipulating ACK signaling RFC3449.  Distinguishing ACK packets is possible in TCP, but is not supported by QUIC, since acknowledgment signaling is carried inside QUIC's encrypted payload, and ACK manipulation is impossible. Specifically, heuristics attempting to distinguish ACK-only packets from payload-carrying packets based on packet size are likely to fail, and are not recommended to use as a way to construe internals of QUIC's operation as those mechanisms can change, e.g., due to the use of extensions. </ins> 3.4.


Limited RTT measurement is possible by passive observation of QUIC traffic; see sec-rtt.  No passive measurement of loss is possible with the present wire image.  Limited observation of upstream <del> congestion may be possible via the observation of CE markings on ECN- enabled QUIC traffic. </del>  On-path devices can also make measurements of RTT, loss and other performance metrics when information is carried in an additional

URL, clarify that the CE marking is observed at IP packet header and also provide a ref to CE marking

Limited RTT measurement is possible by passive observation of QUIC traffic; see sec-rtt.  No passive measurement of loss is possible with the present wire image.  Limited observation of upstream  <ins> congestion may be possible via the observation of CE markings in the IP header RFC3168 on ECN-enabled QUIC traffic. </ins> On-path devices can also make measurements of RTT, loss and other performance metrics when information is carried in an additional


a solution to this problem.  However, hiding information about the change of the IP address or port conceals important and security- relevant information from QUIC endpoints and as such would facilitate <del> amplification attacks (see Section 9 of QUIC-TRANSPORT).  A NAT </del>  function that hides peer address changes prevents the other end from detecting and mitigating attacks as the endpoint cannot verify connectivity to the new address using QUIC PATH_CHALLENGE and

instead of sec 9 (migration)
URL, is this referring to the right section? if yes then can it be made specific to a particular subsection? I noted that RFC9000 describes the potential amplification attack in section 21.3
Yes this should probably be section 8; 21.3 is not relevant here.

a solution to this problem.  However, hiding information about the change of the IP address or port conceals important and security- relevant information from QUIC endpoints and as such would facilitate  <ins> amplification attacks (see Section 8 of QUIC-TRANSPORT).  A NAT </ins> function that hides peer address changes prevents the other end from detecting and mitigating attacks as the endpoint cannot verify connectivity to the new address using QUIC PATH_CHALLENGE and


either through timers or through least-recently-used eviction, depending on application requirements. <del> While QUIC has no clear network-visible end-of-connection signal and </del>  therefore does require timer-based state removal, the QUIC handshake indicates confirmation by both ends of a valid bidirectional transmission.  As soon as the handshake completed, timers should be

URL, in the section 4.2, end-of-flow and end-of-connection both are used in a way that they both point to the same observation event. if these are same then lets stick to only one of them otherwise lets describe in a way that they point to different observation points.
let's use end-of-flow consistently.

either through timers or through least-recently-used eviction, depending on application requirements.  <ins> While QUIC has no clear network-visible end-of-flow signal and </ins> therefore does require timer-based state removal, the QUIC handshake indicates confirmation by both ends of a valid bidirectional transmission.  As soon as the handshake completed, timers should be


2.3.  New QUIC connections are established using a handshake, which is distinguishable on the wire and contains some information that can be passively observed. the 0-RTT data.  The amount of 0-RTT protected data is limited by the initial congestion window, typically around 10 packets RFC6928. <del> 2.4. </del>  As soon as the cryptographic context is established, all information in the QUIC header, including information exposed in the packet header information will lead to a failed integrity check at the receiver, and can even lead to connection termination. <del> 2.5. </del>  The connection ID in the QUIC packet headers allows routing of QUIC packets at load balancers on other than five-tuple information, the new connection ID being negotiated via encrypted frames.  See Section 6.1 of QUIC-TRANSPORT. <del> 2.6. </del>  The packet number field is always present in the QUIC packet header; however, it is always encrypted.  The encryption key for packet end-to-end cryptographic context.  Packet numbers are therefore not part of the wire image that is useful to on-path observers. <del> 2.7. </del>  Version negotiation is not protected, given the used protection mechanism can change with the version.  However, the choices provided

also to address issue
Copying from URL There's no requirement that servers use a particular UDP port for HTTP/QUIC or any other QUIC traffic. Using Alt-Svc, the server is able to pick and advertise any port number and a compliant client will handle it just fine. That's already the case, and isn't part of this issue. updates the HTTP draft to highlight this, increasing the odds that implementations will test and support that case. This issue is to track that it might actually be desirable from a privacy standpoint for servers to pick arbitrary port numbers and perhaps even rotate them periodically (though that requires coordination with their Alt-Svc advertisements and lifetimes, which could be challenging) in order to make it more difficult for a network observer to classify traffic (and therefore more difficult to ossify). On the other hand, as we're wrestling with in each of these privacy/manageability debates, removing easy network visibility into the likely protocol by using arbitrary port numbers means that middleboxes will probably resort to other means of attempting to identify protocols and potentially doing it badly, which could result in even worse ossification. (E.g. indexing into the TLS ClientHello to find the ALPN list, then panicking on a different handshake protocol.) There's further discussion on the original issue, but this belongs in the ops drafts, not the protocol drafts.
this kind-of-but-not-really-duplicates , which I'll go ahead and close.
Actually, it's an exact duplicate, given that it points to the same issue. ;-) My bad.
NAME can you check if PR addresses this issue sufficiently? At least for the applicability doc...
Now also PR for the manageability statement.
and are a (ready for -03) treatment of this; however, we should consider if we want to say more, e.g. such as general guidance / recommendations for using ALPN in QUIC mappings, for instance? Keeping this open to track.
created new issue for ALPN

2.3. <ins> Applications that have a mapping for TCP as well as QUIC are expected to use the same port number for both services.  However, as with TCP- based services, especially when application layer information is encrypted, there is no guarantee that a specific application will use the registered port, or the used port is carrying traffic belonging to the respective registered service.  For example, QUIC-TRANSPORT specifies the use of Alt-Svc for discovery of QUIC/HTTP services on other ports. Further, as QUIC has a connection ID, it is also possible to maintain multiple QUIC connections over one 5-tuple.  However, if the connection ID is not present in the packet header, all packets of the 5-tuple belong to the same QUIC connection. 2.4. </ins> New QUIC connections are established using a handshake, which is distinguishable on the wire and contains some information that can be passively observed. the 0-RTT data.  The amount of 0-RTT protected data is limited by the initial congestion window, typically around 10 packets RFC6928.  <ins> 2.5. </ins> As soon as the cryptographic context is established, all information in the QUIC header, including information exposed in the packet header information will lead to a failed integrity check at the receiver, and can even lead to connection termination.  <ins> 2.6. </ins> The connection ID in the QUIC packet headers allows routing of QUIC packets at load balancers on other than five-tuple information, the new connection ID being negotiated via encrypted frames.  See Section 6.1 of QUIC-TRANSPORT.  <ins> 2.7. </ins> The packet number field is always present in the QUIC packet header; however, it is always encrypted.  The encryption key for packet end-to-end cryptographic context.  Packet numbers are therefore not part of the wire image that is useful to on-path observers.  <ins> 2.8. </ins> Version negotiation is not protected, given the used protection mechanism can change with the version.  However, the choices provided


acceptable to not support migrations of active QUIC connections that are not visible to the network functions performing the DDoS detection.  As soon as the connection blocking is detected by the <del> client, the client may be able to rely on the fast resumption mechanism provided by QUIC.  When clients migrate to a new path, they should be prepared for the migration to fail and attempt to reconnect quickly. </del>  Beyond in-network DDoS protection mechanisms, TCP syncookies RFC4937 are a well-established method of mitigating some kinds of TCP DDoS

Section 4.7 of the manageability draft needs a reference to the fast resumption mechanism.
this s 0-RTT session resumption as explained early in the doc and respectively referred there to the QUIC spec. Would it help to change "fast resumption" to "0-RTT session resumption"?
I think so.
where was in the document 0-RTT session resumption explained? I might have missed it.
He have separate figures for that in the handshake section
However it seems we use the term "0-RTT connection resumption" there so, we should probably do a s/connection/session/ there as well.

acceptable to not support migrations of active QUIC connections that are not visible to the network functions performing the DDoS detection.  As soon as the connection blocking is detected by the  <ins> client, the client may be able to rely on the 0-RTT session resumption mechanism provided by QUIC.  When clients migrate to a new path, they should be prepared for the migration to fail and attempt to reconnect quickly. </ins> Beyond in-network DDoS protection mechanisms, TCP syncookies RFC4937 are a well-established method of mitigating some kinds of TCP DDoS


Initial", "Client Completion", and "Server Completion", in the illustration shown in fig-handshake. <del> Packets in the handshake belong to three separate cryptographic and transport contexts ("Initial", which contains observable payload, and "Handshake" and "1-RTT", which do not).  QUIC packets in separate contexts during the handshake can be coalesced (see coalesced) in order to reduce the number of UDP datagrams sent during the handshake.  QUIC packets can be lost and reordered, so packets within a flight might not be sent close in time, though the sequence of the flights will not change, because one flight depends upon the peer's previous flight. As shown here, the client can send 0-RTT data as soon as it has sent its Client Hello, and the server can send 1-RTT data as soon as it has sent its Server Hello. </del> A handshake starts with the client sending one or more datagrams <del> containing Initial packets as shown in fig-client-initial, which elicits the Server Initial response as shown in fig-server-initial </del>  typically containing three types of packets: Initial packet(s) with the beginning of the server's side of the TLS handshake, Handshake packet(s) with the rest of the server's portion of the TLS handshake, and 1-RTT packet(s), if present. <del> The Client Completion flight contains at least one Handshake packet and could also include an Initial packet. </del>  Datagrams that contain an Initial packet (Client Initial, Server Initial, and some Client Completion) contain at least 1200 octets of

URL here, I propose to rewrite the first part of the paragraph so that it is easy to read. for example - Packets in the handshake belong to three separate cryptographic and transport contexts - "Initial", which contains observable payload, "Handshake", which is not observable "1-RTT", which is not observable Here we are repeating stuffs from RFC9000 without referring to them but I found the figure in RFC9000 more explanatory. why are we rewriting it here instead of just referring to RFC9000 ?
I think it is important to have a figure in this document as reader of this document are not necessarily willing to read RFC9000. Thus this document should be useful as a stand-alone read. The figure in this document is meant to be a simplification compared to the one in RFC900 there it is omitting some of the less relevant details, e.g that there is an initial and a handshake packet.
Also disagree that the diagram in RFC9000 is better for the purposes of this document; would prefer to keep it. The paragraph is a bit difficult to read, though, reflecting the history of this section more than what we actually want to say. Will propose a reordering/simplification...
Ok, I think I understand why you want to keep the figure. I actually had to look at the RFC9000 to understand it better. I hope the promised reordering would help here.

Initial", "Client Completion", and "Server Completion", in the illustration shown in fig-handshake.  A handshake starts with the client sending one or more datagrams  <ins> containing Initial packets, detailed fig-client-initial, which elicits the Server Initial response detailed in fig-server-initial </ins> typically containing three types of packets: Initial packet(s) with the beginning of the server's side of the TLS handshake, Handshake packet(s) with the rest of the server's portion of the TLS handshake, and 1-RTT packet(s), if present.  <ins> As shown here, the client can send 0-RTT data as soon as it has sent its Client Hello, and the server can send 1-RTT data as soon as it has sent its Server Hello.  The Client Completion flight contains at least one Handshake packet and could also include an Initial packet. QUIC packets in separate contexts during the handshake can be coalesced (see coalesced) in order to reduce the number of UDP datagrams sent during the handshake.  QUIC packets can be lost and reordered, so packets within a flight might not be sent close in time, though the sequence of the flights will not change, because one flight depends upon the peer's previous flight. </ins> Datagrams that contain an Initial packet (Client Initial, Server Initial, and some Client Completion) contain at least 1200 octets of


distinguishable from other UDP traffic by a passive observer in the network. <del> The only application binding defined by the IETF QUIC WG is HTTP/3 QUIC-HTTP at the time of this writing; however, many other applications are currently being defined and deployed over QUIC, so an assumption that all QUIC traffic is HTTP/3 is not valid.  HTTP/3 uses UDP port 443 by convention but various methods can be used to specify alternate port numbers.  Simple assumptions about whether a given flow is using QUIC based upon a UDP port number may therefore not hold; see also Section 5 of RFC7605. </del>  While the second-most-significant bit (0x40) of the first octet is set to 1 in most QUIC packets of the current version (see public-

Looks good to me. thanks
URL, this needs examples. what about DNS over QUIC as some defined over QUIC? but I would love to get educated on the deployment part and refer that from this doc to support this statement.

distinguishable from other UDP traffic by a passive observer in the network.  <ins> At the time of writing, two application bindings for QUIC have been published or adopted by the IETF: HTTP/3 QUIC-HTTP and DNS I-D.ietf- dprive-dnsoquic.  These are both known to have active internet deployments, so an assumption that all QUIC traffic is HTTP/3 is not valid.  HTTP/3 uses UDP port 443 by convention but various methods can be used to specify alternate port numbers.  Simple assumptions about whether a given flow is using QUIC based upon a UDP port number may therefore not hold; see also Section 5 of RFC7605. </ins> While the second-most-significant bit (0x40) of the first octet is set to 1 in most QUIC packets of the current version (see public-


RFC4787 requires a network state timeout that is not less than 2 minutes for most UDP traffic.  However, in practice, a QUIC endpoint <del> can experience lower timeouts, in the range of 30 to 60 seconds. </del>  In contrast, RFC5382 recommends a state timeout of more than 2 hours for TCP, given that TCP is a connection-oriented protocol with well-

Looks good to me
URL, where does this data come from? any reference will be great here.
NAME is there something we can cite here?
The best public data I'm aware of is slide 10 of: URL

RFC4787 requires a network state timeout that is not less than 2 minutes for most UDP traffic.  However, in practice, a QUIC endpoint  <ins> can experience lower timeouts, in the range of 30 to 60 seconds QUIC- TIMEOUT. </ins> In contrast, RFC5382 recommends a state timeout of more than 2 hours for TCP, given that TCP is a connection-oriented protocol with well-


4.4. <del> QUIC flow control provides a means of managing access to the limited buffers endpoints have for incoming data.  This mechanism limits the amount of data that can be in buffers in endpoints or in transit on the network.  However, there are several ways in which limits can produce conditions that can cause a connection to either perform suboptimally or deadlock. </del>  Deadlocks in flow control are possible for any protocol that uses QUIC, though whether they become a problem depends on how

addresses
LGTM
URL should this be pointing to Section 2.2 or section 4.0 , flow control credit is described there? I also think it will be good if section 4.4 of this document points to Section 4.0 of RFC9000. specially when it talks about flow control credit updates.
I believe this reference was supposed to point to the following normative statement in 2.2: Section 4 is also relevant but there is also a pointer to section 4 at the end of section 2.2....
I don't think it is obvious here, also introducing "flow control credit" here does not help much without referencing to section 4.0 of RFC9000.
PR add a reference to section 4 of RFC9000 in section 4.4. of the applicability draft. I still think having the link to section 2.2 of RFC900 in section 4.3 is more clear. flow control credit is not a QUIIC specific term.

4.4.  <ins> QUIC flow control Section 4 of QUIC provides a means of managing access to the limited buffers endpoints have for incoming data.  This mechanism limits the amount of data that can be in buffers in endpoints or in transit on the network.  However, there are several ways in which limits can produce conditions that can cause a connection to either perform suboptimally or deadlock. </ins> Deadlocks in flow control are possible for any protocol that uses QUIC, though whether they become a problem depends on how