In this next demonstration,
we're going to take a look at how we can use Wireshark to dig further into QUIC.
Now,
we're going to assume that the QUIC version works
well and the network supports QUIC.
But what analysis tips can we learn by looking at packet flows in Wireshark?
Let's find out.
Okay, so here we are, back in Wireshark,
and we're taking a look at QUIC at the packet level.
And down there on my lower left‑hand side of my screen,
I can see that I'm still in Lab3‑QUIC Streams.
Thought this would just be a good trace file that we can use to take a
look at a few tips in analyzing QUIC in Wireshark.
So let's go ahead and open that up,
and hopefully you still have the TLS session keys selected
so that we can decrypt this trace file and we can do a bit
deeper in our packet digging.
Okay, so one of the first things that I like to look at,
especially when I've captured something client side,
is I can take a look at the delta time between the two initial packets.
So the first one, this is going from client to server,
and then I see server responding coming back to me,
and in this example, I can see that that took 31 ms.
So right there, I still have a measurement of my network Round Trip Time,
at least initially as this QUIC connection was getting going.
Now the thing about QUIC is that,
especially since queries and responses are multiplexed,
I'm often not going to see that 31 ms many times.
So it's not like TCP where I would see a request go,
or especially over http/1.1, I'd see a request go,
then I'd see 31 ms to get an ACK back from the server,
and then a response, and then another request 31 ms later, then a response.
But rather, as things start to take flight,
you're going to notice that that 31 ms, we just don't see it too often.
Again, that's because things start going,
streams are established, and data starts to move.
So at least though, we do get that basic measurement at the start.
Now, with the other tools,
we already talked about the version and how that's set up
at the beginning of the connection.
We've also talked about the handshake and how that gets going,
but something I wanted to show you here with this
trace file is with packet numbers.
Each QUIC packet has a number, and as we can see,
I actually added this as a column.
So let's go ahead and take a look at this first one.
And if I come into the details and I expand out that
first QUIC packet information, here, I can come down to Packet Number.
Now, in this case, this is starting at 0.
So from the client to the server, this is packet number 0.
Now,
I went ahead and right‑clicked that and added that as
a column, and then up above, here,
I can see from the server back to the client that first
packet that it sends back is packet number 1.
After that,
in the opposite direction, from client to server, now I'm using packet number 1.
So this is not cumulative.
It's not additive.
It's each direction can use its own list of packet numbers,
if you will, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 in one direction and 1, 2,
3, 4, 5, 6, 7, 8, 9, 10 in the opposite direction.
Now, if this trace file was not decrypted,
this would be one thing that I would be blind to.
I wouldn't be able to see these packet numbers,
and that becomes pretty useful,
especially as I'm doing troubleshooting for things like packet loss.
So let's take a look at an example of how I can do that.
So if I go ahead and minimize this just a hair, and I notice that
as conversations begin, here I can see several packets coming
from that server back to my client.
And if I take a look at the Packet Number column,
I can see that this is going up by 1, so packet 9,
10, 11, 12, and so on.
So 1 little trick that I like to do is I like to right‑click
the IP address of the server, in this case,
this 216.58 box, and I'm going to come down to Apply as Filter, Selected,
and what that will do is it will set a display filter for all
packets with the source IP of the server, so this is everything
that's coming back to the client.
Now, if I just take a glance at the packet number over here,
here I can see, with starting at packet number 1,
this is counting up by 1, so 1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
11, 12, and so on.
And as I scroll down, I can see that this is just incrementing up.
What that means is, if I do have packet loss somewhere in this QUIC stream,
I would see a number jump, so that's one thing that I'll take a quick peek for.
And this is also an area where I could come up to Wireshark, I could go
to File, and I could say Export, and this is where I could kick out
these packets to CSV, and it would bring my columns with me. And in
Excel, that's where we can get fancy.
We could say, let's go ahead and subtract 44 from 45, okay,
that's 1, so I always want to see only the
difference of 1 between 2 packet numbers.
So anyway, at this period of time, with QUIC, the way that it works,
these numbers go up, and that lets me just take a glance to see if I have any packet loss.