QUIC-Aware Load Balancing: Attacks and Mitigations
Liliana Kistenmacher, Anum Talpur, Mathias Fischer · 2025
QUIC is widely used on the web and is seen as a successor to TCP, with significant improvements to speed, reliability, and security. However, as IP addresses and ports no longer identify QUIC connections but use Connection Identifiers (CIDs), load balancing becomes challenging. In this work, we introduce two novel attacks for revealing the server count behind QUIC-aware load balancers and breaking the unlinkability guarantees that prevent tracking of structured CIDs. We conducted tests on real-world deployments to assess the feasibility of existing and novel attacks. Our results indicate that our attack is more effective in estimating the number of servers behind load balancers than existing work. Furthermore, the data of our second novel attack suggests that almost all observed load balancers are vulnerable, allowing user tracking across networks. This work also introduces novel countermeasures to mitigate these attacks while being faster than existing approaches for enabling secure load balancing.