HTTP/2, HTTP/3 and QUIC

HTTP/2#

HTTP/2 decryption is part of WireLens's main engine and is always on. There is nothing to enable.

The protocol a connection uses is decided the way it always is: the client and the server agree on it during the TLS handshake. WireLens offers HTTP/2 and HTTP/1.1 to the app, uses what the app picks, and does the same towards the server. Every flow shows the version that was actually negotiated, in the Proto column and the inspector.

When the two sides disagree, for example the app speaks HTTP/2 but the server only answers HTTP/1.1, WireLens bridges them and records the downgrade honestly instead of reporting HTTP/2 end to end.

gRPC depends on HTTP/2 all the way to the server, and WireLens speaks it upstream. See gRPC, GraphQL and Protobuf.

The experimental HTTP/2 switch#

Settings ▸ Network ▸ HTTP/2 (experimental) on the Mac is an opt-in preference for HTTP/2 work that is still being tested. It does not choose the protocol for any connection: WireLens always follows the negotiated handshake, whether the switch is on or off. Leave it off unless we have asked you to try something.

HTTP/3 and QUIC#

HTTP/3 runs over QUIC, which uses UDP instead of TCP. Browsers and many apps try it first when a server advertises it, and a proxy that only handles TCP never sees that traffic.

WireLens's answer is Block QUIC, on both platforms. When it is on, WireLens refuses QUIC connections so clients fall back to HTTP/2 or HTTP/1.1 over TLS, which WireLens captures and decrypts like everything else. Nothing slips past the capture unseen.

• Mac: Settings ▸ Network ▸ Block QUIC, described in the app as forcing clients onto TCP, where WireLens can decrypt them.
• iPhone and iPad: Block QUIC in capture settings. The local VPN drops QUIC's UDP traffic, and apps fall back to TCP.

HTTP/1.1#

HTTP/1.1 is captured and decrypted as you would expect, including keep-alive connections that carry many requests, chunked bodies and Upgrade to WebSocket.