QUIC Frame Reference
Common QUIC frame types with their hex codes and purpose.
Overview
The QUIC frame reference lists every QUIC frame type defined in RFC 9000 with its numeric code, purpose, and typical usage. STREAM, ACK, CRYPTO, NEW_CONNECTION_ID, PATH_CHALLENGE, CONNECTION_CLOSE, and the rest are grouped by function so you can navigate from a packet capture or a Wireshark trace back to the spec.
Protocol implementers writing a QUIC stack, network engineers parsing QUIC traffic in a SIEM, and curious readers diving into HTTP/3 internals all need a frame-type cheat sheet. Long-tail keywords covered: QUIC frame type codes list, what is a CRYPTO frame in QUIC, and STREAM frame format reference.
How it works
A QUIC packet's payload is a sequence of frames. Each frame starts with a variable-length integer type code, followed by type-specific fields. Frame types 0x00 through 0x1e are defined by the core spec; extensions allocate higher numbers. The most important frames in normal traffic are STREAM (carries application data), ACK (acknowledges received packets), CRYPTO (carries the TLS handshake), and the connection-management family (NEW_CONNECTION_ID, RETIRE_CONNECTION_ID, PATH_CHALLENGE, PATH_RESPONSE).
Frames are not packets. A single QUIC packet may contain many frames, and a single application write may be split across many frames in many packets. The transport ensures ordering within a stream but lets streams be reassembled independently — the property that gives QUIC its head-of-line-blocking immunity.
Examples
0x00 PADDING— fills a packet to a minimum size, often used to inflate Initial packets to 1200 bytes.0x06 CRYPTO— carries TLS handshake bytes during connection setup.0x08–0x0F STREAM— carry application data; the low bits encode whether offset, length, and FIN are present.0x18 NEW_CONNECTION_ID— provides additional connection IDs the peer can use after migration.
FAQ
Why does STREAM occupy a range of codes instead of a single one?
The low three bits of the type code (0x08–0x0F) flag whether an offset is included, whether a length field is present, and whether the FIN bit is set. Packing these into the type byte saves a few bytes per frame.
What does the ACK frame's ECN section do?
It echoes Explicit Congestion Notification counts back to the sender so it can react to congestion before packet loss occurs.
Are frame types negotiated?
Most are mandatory. Extensions like DATAGRAM (RFC 9221) use higher type codes and are negotiated via transport parameters during the handshake.
Where do I see these frames in practice?
Wireshark decrypts QUIC if you have the TLS keys (SSLKEYLOGFILE), and shows each frame in the dissector tree. Many CDNs also expose QUIC frame counters via their analytics APIs.