# Quic detect not work

**URL:** <https://forum.suricata.io/t/quic-detect-not-work/4174>\
**Category:** Help\
**Tags:** suricata\
**Created:** [November 13, 2023, 10:28am UTC](https://forum.suricata.io/t/quic-detect-not-work/4174 "2023-11-13T10:28:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wsn1983](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/wsn1983/32/2443_2.png) [@wsn1983](https://forum.suricata.io/u/wsn1983)\
**Post date:** [November 13, 2023, 10:28am UTC](https://forum.suricata.io/t/quic-detect-not-work/4174/1 "2023-11-13T10:28:38Z")

</div>

hi there is an example show that quic can not detect well.  
udp port not 443 or 80  
[quic.pcap](https://forum.suricata.io/uploads/short-url/veP0bXTFe5QEupzxEQ1gB6yoVpE.pcap) (43.5 KB)

alert quic any any → any any (msg:“QUIC TEST”; sid:999;)

Suricata 7.0.1-dev (f58bc4d 2023-10-12)

UPDATE  
modify quic decoder,add 16847 into the default port list ,it works.  
why the any(dest port) not work?

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [December 12, 2023, 10:14pm UTC](https://forum.suricata.io/t/quic-detect-not-work/4174/2 "2023-12-12T22:14:03Z")

</div>

Quic detection relies on port, as there are no fixed patterns for port-independent detection.

Wonder if |C2 00 00 00 01| would be a good pattern…

---

<div class="post-metadata">

**Author:** ![wsn1983](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/wsn1983/32/2443_2.png) [@wsn1983](https://forum.suricata.io/u/wsn1983)\
**Post date:** [December 22, 2023, 8:55pm UTC](https://forum.suricata.io/t/quic-detect-not-work/4174/3 "2023-12-22T20:55:45Z")

</div>

here is my rule.  
alert udp any any → any ![443,80] (msg:“quic init request”; content:“|c2 00 00 00 01 14|”; depth:6; sid:3; rev:1;)  
but i want see the sni info in the eve log.  
i am try to write a “text parser” for quic protocol.

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [December 22, 2023, 9:55pm UTC](https://forum.suricata.io/t/quic-detect-not-work/4174/4 "2023-12-22T21:55:27Z")

</div>

To get sni, we need to recognize quic first.  
To do so, we can add ports for detection with probing parser in suricata.yaml configuration.  
Or we need to modify suricata code, to add a fixed pattern like | 00 00 00 01| | at offset 1 (which can be followed by a probing parser to check)

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [December 29, 2023, 8:41am UTC](https://forum.suricata.io/t/quic-detect-not-work/4174/5 "2023-12-29T08:41:21Z")

</div>

[Feature #6651: quic: detect on non-standard ports - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/6651) to track this feature