QUIC load balancing can be moved to the data plane without state storage. This reduces latency and eliminates dependence on middlebox logic.
The first bottleneck of classical load balancing is maintaining per-connection consistency (PCC). In a software approach, this is solved by storing the mapping of flow → backend. However, when moving logic to the programmable data plane, a limitation arises: memory is limited, and processing must occur at line rate. As soon as the pool of servers changes or load-aware logic is enabled, the hash no longer guarantees a stable mapping, and the system begins to lose consistency. In TCP, this is exacerbated by the lack of a built-in mechanism for transmitting server identity, which forces either state storage or packet modification.
The solution is built around the features of QUIC. Unlike TCP, QUIC allows for changing IP and UDP port without breaking the session. This enables a hybrid model: only the first packet is processed by the load balancer, while all subsequent packets go directly to the backend. There is no need to modify the Connection ID (CID), which is important for compliance with the specification and operation in a multi-tenant environment. The trade-off here is clear: we eliminate state and latency, but open the possibility of bypassing the load balancer, as the client learns the real address of the server.
The implementation relies on a programmable data plane (PISA) and deep packet parsing. The load balancer accepts only the initial QUIC packet directed to the Virtual IP (VIP) and selects the backend through ECMP hashing. The server then responds directly to the client from its IP and port, and the client continues communication without the involvement of the load balancer. The key challenge is distinguishing the first packet of the QUIC session from subsequent packets. In QUIC, this is not obvious due to packet coalescing: multiple headers can be present in a single UDP datagram. A simple packet type check does not work.
To address this, lookahead parsing is used in the data plane. The system analyzes the presence of a second QUIC long header within the datagram. The first packet contains only one header of type Initial. Subsequent packets may contain coalesced headers, including Handshake. This allows for accurate determination of the start of a new session. If the initial packet is directed straight to the backend, bypassing the VIP, it is discarded. This prevents a complete bypass of the load balancer.
An additional layer is protection against 0-RTT attacks. QUIC allows sending data without a full handshake, using a previously issued TLS session ticket. This creates an attack vector: an attacker can spoof the source IP and initiate a stream of responses to the victim. In the proposed architecture, protection is again moved to the data plane. Through deep parsing, the presence of 0-RTT packets is determined (by the second header), after which a counter with a threshold (rate limiting) is applied. If the threshold is exceeded, packets are discarded. It is important that the protection operates at the network level, not at the individual server level.
The results show two effects. First, without deep parsing, the load is distributed unevenly: some clients access the backend directly, creating a hotspot. Second, when analysis is enabled, traffic is balanced by forcing the initial packet to pass through the load balancer. Exact metrics of the increase are not provided, but an improvement in load distribution is shown. It is also noted that deep parsing does not result in a measurable increase in latency even in an emulated environment.
The final architecture is a compromise but a pragmatic solution. It removes the need to store state in the switch and minimizes the load balancer’s involvement in the data stream. At the same time, security and correctness are achieved through more complex packet analysis. The approach fits well with modern cloud-native clusters and Kubernetes infrastructure, where control over the data plane becomes a key optimization tool.
Information source
arXiv is the largest open preprint repository (since 1991, under the auspices of Cornell), where researchers quickly post working versions of papers; the materials are publicly accessible but do not undergo full peer review, so results should be considered preliminary and, where possible, checked against updated versions or peer‑reviewed journals. arxiv.org