QUIC / HTTP3 times out on UDP 443: how to narrow down the cause

UDP Echo, QUIC and HTTP/3 are different checks

HTTP/3 generally uses QUIC over UDP 443. Sending a UDP packet does not establish a QUIC connection. A successful QUIC handshake does not establish that an HTTP/3 response was received. Protocol-specific checks avoid confusing these cases.

1. Establish an HTTPS control

pathtrial http https://example.com/ --format json

Replace example.com with a hostname you may test. Successful TLS over TCP alongside a QUIC timeout establishes different observations, not the reason for the difference.

2. Attempt a real QUIC handshake

pathtrial quic example.com --port 443 --alpn h3

The target must support QUIC, certificate verification and the requested ALPN. A timeout can have multiple explanations, including endpoint configuration or network loss; it cannot by itself prove censorship, UDP filtering or lack of HTTP/3 support. Certificate and ALPN errors are separate measured outcomes.

3. Check an actual HTTP/3 request

pathtrial http3 https://example.com

The result concerns that HTTP/3 request. A working QUIC transport with an application error should be investigated at the application layer. Not every public site advertises or enables HTTP/3.

4. Do not test a public QUIC server with UDP Echo

UDP Echo requires a compatible Echo server; an HTTPS endpoint is not an Echo service. You can test a controlled local Echo service on loopback, but its success does not imply QUIC success on another route.

# Terminal A, on a machine you control:
pathtrial endpoint --udp-echo --bind 127.0.0.1:39001
# Terminal B, same machine:
pathtrial udp --target 127.0.0.1:39001 --mode echo --rounds 5

5. Compare measurements fairly

Repeat the same hostname, destination port, protocol and budget from authorized networks, recording the time, address family and actual error classification. IPv4 and IPv6 routes may differ. Inspect the report for SKIP and INCONCLUSIVE. A Mac with a restricted UDP exit path may time out even when the remote service is operational elsewhere.

Report findings responsibly

Include PathTrial version, operating system, the tested command, observed layer and reproducible conditions. Remove proxy credentials, sensitive URLs and private network metadata before attaching diagnostics to a public issue.