HoneyLabs

UDP traffic / QUIC transport parameter fingerprint

4c2cac1ef1cb

QUIC transport parameter fingerprint. 15 datagrams in the last 30 days, last seen 2026-10-10 18:23 UTC.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Parameters as offered

1=10000,4=65536,5=65536,6=65536,7=65536,8=10,9=10,e=4,f/8

15

Datagrams

15

Source addresses

1

Networks

1

Countries

2

Destination ports

Traffic by type

QUIC

15 datagrams from 15 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=h3-29,h3

Destination ports

QUIC clients (JA4)

QUIC transport parameters

QUIC versions

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
195.96.139.190AS211298 Driftnet LtdGBQUIC12026-10-06 00:59
195.96.139.149AS211298 Driftnet LtdGBQUIC12026-10-06 01:10
195.96.139.150AS211298 Driftnet LtdGBQUIC12026-10-10 05:59
87.236.176.249AS211298 Driftnet LtdGBQUIC12026-10-10 11:41
87.236.176.248AS211298 Driftnet LtdGBQUIC12026-10-08 18:32
87.236.176.230AS211298 Driftnet LtdGBQUIC12026-10-09 05:54
195.96.139.42AS211298 Driftnet LtdGBQUIC12026-10-07 01:50
87.236.176.227AS211298 Driftnet LtdGBQUIC12026-10-08 04:40
87.236.176.38AS211298 Driftnet LtdGBQUIC12026-10-06 08:18
195.96.139.94AS211298 Driftnet LtdGBQUIC12026-10-10 18:23
87.236.176.148AS211298 Driftnet LtdGBQUIC12026-10-07 09:01
195.96.139.124AS211298 Driftnet LtdGBQUIC12026-10-09 00:37
185.247.137.165AS211298 Driftnet LtdGBQUIC12026-10-06 09:53
87.236.176.245AS211298 Driftnet LtdGBQUIC12026-10-06 10:19
185.247.137.73AS211298 Driftnet LtdGBQUIC12026-10-08 17:12

Latest datagrams

About this fingerprint

A hash of the QUIC transport parameters a client offers: which parameters it sends and the values it picks for flow-control limits, idle timeout and connection IDs. Parameter order and GREASE values are normalised before hashing. Two clients with the same TLS stack but different QUIC libraries usually differ here.