Build it in Go (25 min) — see how a site advertises each version

This lab requests a site twice (once allowing only HTTP/1.1, once allowing HTTP/2), reads Alt-Svc, and decodes the DNS HTTPS record by hand:

// protoprobe: which HTTP versions does a site offer, and how is each one
// discovered? Compares HTTP/1.1 and HTTP/2 over TLS (ALPN), reads Alt-Svc,
// and decodes the DNS HTTPS record (type 65) that can advertise h3 up front.
//
//	go run ./protoprobe cloudflare.com
//	go run ./protoprobe www.google.com
package main

import (
	"crypto/tls"
	"encoding/binary"
	"fmt"
	"math/rand/v2"
	"net"
	"net/http"
	"os"
	"strings"
	"time"
)

func main() {
	if len(os.Args) != 2 {
		fmt.Println("usage: protoprobe HOST")
		os.Exit(2)
	}
	host := os.Args[1]
	url := "https://" + host + "/"

	// 1. Force HTTP/1.1: a non-nil, empty TLSNextProto map disables HTTP/2,
	//    so ALPN offers only "http/1.1".
	h1 := &http.Transport{TLSNextProto: map[string]func(string, *tls.Conn) http.RoundTripper{}}
	// 2. Allow HTTP/2: ALPN offers "h2" first.
	h2 := &http.Transport{ForceAttemptHTTP2: true}

	for _, t := range []struct {
		name string
		rt   http.RoundTripper
	}{{"HTTP/1.1 only", h1}, {"HTTP/2 allowed", h2}} {
		c := &http.Client{Transport: t.rt, Timeout: 10 * time.Second,
			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
		start := time.Now()
		resp, err := c.Get(url)
		if err != nil {
			fmt.Printf("%-15s error: %v\n", t.name, err)
			continue
		}
		resp.Body.Close()
		fmt.Printf("%-15s -> %-8s %s in %v\n", t.name, resp.Proto, resp.Status, time.Since(start).Round(time.Millisecond))
		if t.name == "HTTP/2 allowed" {
			if alt := resp.Header.Get("Alt-Svc"); alt != "" {
				fmt.Printf("%-15s    Alt-Svc: %s   <- HTTP/3 offered for NEXT time\n", "", alt)
			} else {
				fmt.Printf("%-15s    no Alt-Svc header: no HTTP/3 advertised over HTTP\n", "")
			}
		}
	}

	// 3. The DNS HTTPS record lets a browser learn about h3 BEFORE connecting.
	alpn, err := httpsRecordALPN(host)
	switch {
	case err != nil:
		fmt.Println("HTTPS record:   lookup failed:", err)
	case alpn == nil:
		fmt.Println("HTTPS record:   none published")
	default:
		fmt.Printf("HTTPS record:   alpn=%v   <- usable on the FIRST connection\n", alpn)
	}
	fmt.Println("\n(Go's standard library has no HTTP/3 client; browsers, curl --http3, and")
	fmt.Println(" libraries such as quic-go do. This tool shows how h3 is DISCOVERED.)")
}

// httpsRecordALPN sends a raw DNS query for type 65 (HTTPS, RFC 9460) and
// returns the alpn SvcParam of the first record. See the TCP/IP guide's
// dnsquery lab for the wire format.
func httpsRecordALPN(host string) ([]string, error) {
	q := make([]byte, 12, 512)
	id := uint16(rand.N(1 << 16))
	binary.BigEndian.PutUint16(q[0:], id)
	binary.BigEndian.PutUint16(q[2:], 0x0100) // recursion desired
	binary.BigEndian.PutUint16(q[4:], 1)
	for _, l := range strings.Split(strings.TrimSuffix(host, "."), ".") {
		q = append(q, byte(len(l)))
		q = append(q, l...)
	}
	q = append(q, 0, 0, 65, 0, 1) // QTYPE=65 (HTTPS), QCLASS=IN

	c, err := net.Dial("udp", "1.1.1.1:53")
	if err != nil {
		return nil, err
	}
	defer c.Close()
	c.SetDeadline(time.Now().Add(3 * time.Second))
	c.Write(q)
	m := make([]byte, 1232)
	n, err := c.Read(m)
	if err != nil {
		return nil, err
	}
	m = m[:n]
	if n < 12 || binary.BigEndian.Uint16(m) != id {
		return nil, fmt.Errorf("bad reply")
	}
	an := int(binary.BigEndian.Uint16(m[6:]))
	off := skipName(m, 12) + 4 // skip the question
	for i := 0; i < an && off > 0 && off+10 <= n; i++ {
		off = skipName(m, off)
		typ := binary.BigEndian.Uint16(m[off:])
		rdlen := int(binary.BigEndian.Uint16(m[off+8:]))
		rd := off + 10
		off = rd + rdlen
		if typ != 65 || off > n {
			continue // e.g. a CNAME in front of the HTTPS record
		}
		// RDATA: SvcPriority(2) TargetName(name) then key(2) len(2) value...
		p := skipName(m, rd+2)
		for p+4 <= off {
			key, l := binary.BigEndian.Uint16(m[p:]), int(binary.BigEndian.Uint16(m[p+2:]))
			v := m[p+4 : min(p+4+l, off)]
			if key == 1 { // alpn: a list of length-prefixed protocol IDs
				var out []string
				for j := 0; j < len(v); j += 1 + int(v[j]) {
					out = append(out, string(v[j+1:min(j+1+int(v[j]), len(v))]))
				}
				return out, nil
			}
			p += 4 + l
		}
		return []string{}, nil // record exists, no alpn key
	}
	return nil, nil
}

// skipName returns the offset just after a (possibly compressed) DNS name.
func skipName(m []byte, off int) int {
	for off < len(m) {
		l := int(m[off])
		switch {
		case l == 0:
			return off + 1
		case l&0xC0 == 0xC0:
			return off + 2
		default:
			off += 1 + l
		}
	}
	return -1
}

Real results:

$ go run ./protoprobe cloudflare.com
HTTP/1.1 only   -> HTTP/1.1 301 Moved Permanently in 129ms
HTTP/2 allowed  -> HTTP/2.0 301 Moved Permanently in 251ms
                   Alt-Svc: h3=":443"; ma=86400   <- HTTP/3 offered for NEXT time
HTTPS record:   alpn=[h3 h2]   <- usable on the FIRST connection

$ go run ./protoprobe github.com
HTTP/1.1 only   -> HTTP/1.1 200 OK in 263ms
HTTP/2 allowed  -> HTTP/2.0 200 OK in 114ms
                   no Alt-Svc header: no HTTP/3 advertised over HTTP
HTTPS record:   none published

What to notice:

• A non-nil, empty TLSNextProto map is Go's documented way to switch off HTTP/2 in a client. With it, ALPN offers only http/1.1.
• Not every major site uses HTTP/3. At the time of testing, GitHub advertised it neither in Alt-Svc nor in DNS. "Every user gets HTTP/3" is never a safe assumption.
• Go's standard library has no HTTP/3 implementation. Go servers usually sit behind a CDN or proxy that terminates QUIC, or use the quic-go library. That's why Go services so often speak HTTP/2 or HTTP/1.1 to their own load balancer even when users see HTTP/3.

Exercises:

1. Run it against five sites you use daily. Which publish an HTTPS record? Which advertise h3 only in Alt-Svc?
2. With curl --http3 (if your curl supports it), compare curl -w '%{http_version} %{time_appconnect}\n' over HTTP/3 and HTTP/2 to the same site.
3. Block UDP/443 on your machine (macOS: pfctl; Linux: sudo iptables -A OUTPUT -p udp --dport 443 -j DROP), load a site in Chrome, and check the Protocol column in DevTools → Network. It falls back to h2 with no visible error. Remove the rule afterwards.