So before we can get into the QUIC handoff and see
how it hands off from TCP to QUIC, first we need to learn how to decrypt QUIC,
so let's take a quick look at that in this demonstration.
So when I go into Wireshark you're going to see here I have Lab1‑QUIC open,
so feel free to get that open on your copy of Wireshark.
Now, decryption requires that we have some QUIC keys or the keys,
the TLS keys, the session keys,
that happened when that QUIC session actually took place.
So, you're going to find that in the files that came along with this module,
you're going to see that you have the QUIC keys log.
So, go ahead and find that file,
and now I want to show you how and where to apply it in Wireshark.
So if you're on a Mac system,
you can go up to the top and you can come to Wireshark,
Preferences.
However, if you're on a Windows system,
you can go over to Edit and you're going to see under Edit that
you can find Preferences down under there.
So, if I go ahead and go back to Preferences there,
now preferences is up and I want to come to Protocols.
Now keep in mind that QUIC uses TLS as its encryption method.
It's basically built into QUIC.
So in order to decrypt QUIC, we have to come down to the TLS protocol.
Now I just hit the T key and that jumped me down on
the menu a little bit further, but I'm going to come down to TLS,
and after I select TLS then I can come into the
(Pre)‑Master‑Secret log file name,
and that is where you want to enter the QUIC‑keys.log file that
you also received along with this trace file.
So go ahead and browse for it, add it, and then select OK. Now
you're going to know that this worked if you see,
for example on packet 21, if you see the application layer protocol there.
So in that example it's HTTP2. Or better yet,
if we come down to where we see QUIC in this trace file,
if we see HTTP3 on packet number 42, then you know that you have this
trace file properly decrypted for the next demo. So, let's now go ahead and take a look at that handoff.