A QUIC flood is a Layer 4 attack vector, one of the attack classes a thorough DDoS test is built to exercise. QUIC is the UDP-based transport under HTTP/3, terminating on UDP 443. A QUIC flood sends high rates of Initial packets or connection requests, forcing the server through expensive cryptographic handshakes and per-connection state setup. Because QUIC rides on UDP, spoofed-source floods also bypass the stateful filtering that protects classic TCP services.
Why it matters in DDoS testing
As HTTP/3 adoption grows, the QUIC handshake becomes a fresh compute-exhaustion surface that older mitigations were never tuned for. Testing characterizes how the edge handles a flood of half-formed connections: whether address-validation tokens (Retry packets) blunt spoofing, and where CPU spent on handshakes first starves real users. How providers terminate and absorb edge transport floods is compared in AWS Shield vs Cloudflare DDoS Protection.