But let's take a look at how this handoff actually works in Wireshark.
So go ahead and open up the trace file for Lab1,
and make sure that you have the key log file loaded to decrypt the session,
and follow right along.
So in this demo, we're going to go ahead and just, once again, open up Lab1.
That's the lab that we used for the first module,
and hopefully you still have that decryption key there loaded.
If not,
go ahead and go into your protocol preferences and make
sure to load that key for this lab.
Now, here we have just a simple trace file.
We've only got 88 packets, and if I just take a quick little scroll through here,
we can see that we've got some TCP, TLS,
HTTP2, and if I come down here, then I see my QUIC.
So what we want to focus on here is how the QUIC handoff happens.
That's what we're going to key in here.
So I'm just going to come up to the top.
And if I look at this client connecting to the server, first over TCP.
So there's my DNS conversation.
DNS goes out.
Okay, let's go ahead and resolve youtube.com.
I see that IP address come back.
Then the client goes ahead and sends that TCP SYN.
So I want to focus just on this connection.
I'm going to right‑click that packet, that fourth one down,
going to come down a Conversation Filter,
and let's go ahead and go to TCP.
So this will let me examine just that facet of the connection.
So we have our handshake, and then immediately after that handshake,
we see our Client Hello go off to the server,
the server turns around and establishes the rest of that TLS 1.3 connection,
got my Server Hello, and then the encrypted extensions,
the certificate that comes back from the server,
and then here, we can see that that connection is finished.
So now, we've got our TCP connection, we've got our encryption set up,
and now we can go ahead and start to actually move some data.
Now, the client in packet 22, let's go ahead and jump down there.
So packet 22, we can see on one of these streams,
we're going to learn about those in just a few minutes here in this module,
but in one of the streams, we see the client send a GET to the server.
Now, here's that GET / that we see there in the information view.
Now, if we take a look at the server's responses,
this is what we want to focus in on.
So the server comes back in the opposite direction.
I can see down here, this is for HEADER[15],
since this is STREAM[15]: 302 Found.
This is the packet we want to look at.
So let's go ahead and expand this,
and we want to come down here and look at the details.
So I'm going to go ahead and jump down to HTTP2,
going to open that up, and here we can see some Stream: HEADER information,
again, that's what we're going to talk about in just a moment in this module,
but what we want to focus on is that the server is coming back and saying,
hey, 302 Found.
I found youtube.com.
No problem, we can go ahead and do this conversation, not an issue whatsoever.
And in fact, here's a cookie.
Here's some other information.
But let's go ahead and go down to the bottom.
This is what I want you to take a look at.
If we go down to the very last Header value,
if we expand this, here, the server is suggesting an alternate service.
It's saying, hey, client, just so you know, I also can do HTTP/3.
And if we look at that ‑ 29, that actually means QUIC version 29.
So since QUIC is still an emerging protocol,
this server is advertising, hey, I can do version 29,
I can do T051, I can do some of the older versions of QUIC.
If you support any of these,
let's go ahead and switch this connection over to HTTP/3 over UDP QUIC,
and I'm also going to tell you the port number to use.
So the server is saying, look, if you come back on UDP 443,
that will be the transport layer port that I'm listening to.
And as long as we're using any of these versions of QUIC,
then we'll go ahead and be able to hand that over.
So this is the response coming back from the server.
This is the server suggesting this alternate service.
So let's go ahead and see what happens.
I'm going to go ahead and expand this just a moment,
and I'm going to remove my filter. Because remember,
QUIC is not over TCP. So here is our 302 Found,
so that's packet 28.
And if I scroll down a little bit, this is where,
not much longer after this, down on packet 33,
this is where the server says, hey, let's go ahead and use QUIC.
Now, if I come down on Packet 33, I can take a look at the UDP information.
It's sending this to destination port 443.
And if I look at the QUIC info inside that first QUIC packet,
I can see here Version: draft‑29.
That's the version of QUIC that we're using.
And at this point in time, that needs to match.
If I'm using draft‑29 on a client, I have to use draft‑29 on the server.
So this was an example of how a server can help a client to hand off from TCP to QUIC.