UDP traffic / QUIC transport parameter fingerprint

5826be32c2d4

QUIC transport parameter fingerprint. 2 datagrams in the last 30 days, last seen 2026-10-07 18:46 UTC.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Parameters as offered

3=1472,4=16777216,5=65536,6=65536,7=65536,a=8,b=41,e=4,f/0,ff04de1b=16000

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

QUIC

2 datagrams from 2 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 2

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=smb

Destination ports

443/udp QUIC2

QUIC clients (JA4)

q13i0213sb_62ed6f6ca7ad_03ad308c6343 from 2 sources2

QUIC transport parameters

5826be32c2d4 from 2 sources2

QUIC versions

Networks

AS29470 JSC RetnNet from 1 source1
AS24955 JSC Ufanet from 1 source1

Countries

RU Russia2

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
46.46.137.198	AS29470 JSC RetnNet	RU	QUIC	1	2026-10-07 18:46
94.41.245.248	AS24955 JSC Ufanet	RU	QUIC	1	2026-10-07 15:11

Latest datagrams

2026-10-07 18:46:5946.46.137.198to 443/udpQUICRU
QUIC v1 Initial alpn=smb
2026-10-07 15:11:5294.41.245.248to 443/udpQUICRU
QUIC v1 Initial alpn=smb

About this fingerprint

A hash of the QUIC transport parameters a client offers: which parameters it sends and the values it picks for flow-control limits, idle timeout and connection IDs. Parameter order and GREASE values are normalised before hashing. Two clients with the same TLS stack but different QUIC libraries usually differ here.