HTTP/3 Benchmarks: QUIC Performance on Lossy Networks with Packet Analysis

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

HTTP/2:                    HTTP/3:
┌─────────────┐            ┌─────────────┐
│   HTTP/2    │            │   HTTP/3    │
├─────────────┤            ├─────────────┤
│    TLS 1.3  │            │    QUIC     │ ← Transport + encryption merged
├─────────────┤            │  (incl TLS) │
│     TCP     │            └──────┬──────┘
└─────────────┘                   │
                                  │
                            ┌─────▼─────┐
                            │    UDP    │
                            └───────────┘

1
2
3
4
5
6
7
8

# Add 100ms delay + 5% packet loss
sudo tc qdisc add dev eth0 root netem delay 100ms loss 5%

# Check current settings
tc qdisc show dev eth0

# Restore normal
sudo tc qdisc del dev eth0 root

1
2
3

# Check if site supports HTTP/3
curl -I https://cloudflare.com 2>&1 | grep -i alt-svc
# alt-svc: h3=":443"  ← Supports HTTP/3

1
2
3
4
5
6
7

# Check curl version (need 7.66+)
curl --version | grep HTTP3

# If not supported, install HTTP/3-enabled version
# Ubuntu:
sudo add-apt-repository ppa:savoury1/curl34
sudo apt update && sudo apt install curl

1
2
3
4
5

# HTTP/2
curl -w "Total: %{time_total}s\n" -o /dev/null -s --http2 https://cloudflare.com

# HTTP/3
curl -w "Total: %{time_total}s\n" -o /dev/null -s --http3 https://cloudflare.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Add delay
sudo tc qdisc add dev eth0 root netem delay 100ms

# Test
for i in {1..10}; do
  echo "=== HTTP/2 ==="
  curl -w "%{time_total}s\n" -o /dev/null -s --http2 https://cloudflare.com
  echo "=== HTTP/3 ==="
  curl -w "%{time_total}s\n" -o /dev/null -s --http3 https://cloudflare.com
done

1
2
3
4
5
6

# Add packet loss
sudo tc qdisc change dev eth0 root netem delay 50ms loss 5%

# Test (load a large page)
time curl -o /dev/null -s --http2 https://www.cloudflare.com/
time curl -o /dev/null -s --http3 https://www.cloudflare.com/

1
2
3
4
5
6
7

# Need to set SSLKEYLOGFILE to decrypt QUIC
export SSLKEYLOGFILE=/tmp/keylog.txt
curl --http3 https://cloudflare.com

# In Wireshark:
# Edit → Preferences → Protocols → TLS
# Set (Pre)-Master-Secret log filename: /tmp/keylog.txt

1
2
3
4
5
6
7
8
9

Timeline:
  Stream 1: [Packet 1] [Packet 2] ...
  Stream 2: [Packet 1] [Packet 2] ...
  Stream 3: [Packet 1] [Packet 2] ...

If Stream 1's Packet 1 is lost:
  TCP: Wait for retransmission... (ALL streams are blocked!)
        ↓
  Stream 2, 3 data has arrived, but can't be delivered to app

1
2
3
4

QUIC implements multiplexing over UDP:
  Stream 1: [Packet 1 lost] → Retransmit
  Stream 2: [Processing normally] ← Not affected!
  Stream 3: [Processing normally] ← Not affected!

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Simulate WiFi → 4G switch
# 1. Start download
curl --http3 -O https://terra-nas.com/largefile.bin &

# 2. Switch network interface
sudo ip route change default via 192.168.1.1 dev wlan0
sudo ip route change default via 10.0.0.1 dev eth0

# 3. Observe if download is interrupted
# HTTP/3: Continues (Connection ID unchanged)
# HTTP/2: Connection drops, needs to reconnect

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Connection level: Limits total flow across all Streams
Stream level: Limits individual Stream flow

┌─────────────────────────────────────┐
│ Connection Window = 1MB             │
│ ┌───────────┐ ┌───────────┐        │
│ │ Stream 1  │ │ Stream 2  │ ...    │
│ │ Window=   │ │ Window=   │        │
│ │ 256KB     │ │ 256KB     │        │
│ └───────────┘ └───────────┘        │
└─────────────────────────────────────┘

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

TCP packet loss recovery:
  Send: 1, 2, 3, 4, 5
  ACK:  1, 2, -  (3 lost)
  Wait for timeout... or 3 duplicate ACKs
  Retransmit: 3

QUIC packet loss recovery:
  Each packet has a unique, incrementing sequence number
  ACK packets contain detailed received ranges
  More accurate RTT estimation
  Faster retransmission triggering

1
2
3
4
5
6
7
8

First connection:
  Client → Server: ClientHello + supported keys
  Client ← Server: ServerHello + cert + Session Ticket
  Client → Server: Start sending encrypted data

Subsequent connections:
  Client → Server: ClientHello + EarlyData (using previous Session Ticket)
  Data is already transmitting! No need to wait for handshake

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# Requires Nginx 1.25+ or nginx-quic
server {
    listen 443 ssl;
    listen 443 quic reuseport;
    
    http2 on;
    http3 on;
    http3_hq on;
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    # Tell clients HTTP/3 is supported
    add_header Alt-Svc 'h3=":443"; ma=86400';
}