Beyond HTTP/2: Evaluating the Cryptographic Resilience of gRPC over QUIC (HTTP/3) vs. REST in Highly Saturated Distributed Meshes

Abstract

Selecting a communication protocol for high-concurrency microservice deployments is rarely straightforward, and our experience building this benchmark confirmed that the tradeoffs are sharper than the literature suggests. We evaluated four protocol stacks—HTTP/1.1 (REST), HTTP/2 (REST), HTTP/3/QUIC (REST), and gRPC/HTTP-2—under two connection regimes that, in practice, represent fundamentally different operational contexts: connection reuse across 50,000 requests, and new-connection establishment across 5,000 requests, with concurrency swept from 10 to 500 in-flight workers.  The reuse results were, frankly, unsurprising. gRPC/HTTP-2 held a stable throughput near 26,000 req/s throughout, and its p95 latency never exceeded 25 ms even at 500 workers—numbers consistent with what its multiplexed stream model would predict. What we did not anticipate was the severity of what happened under the new connection load. At 200 concurrent workers, both HTTP/1.1 and gRPC collapsed: success rates dropped to 0.04% and 0.28%, respectively, a failure mode our CPU traces attributed to socket exhaustion and repeated TLS 1.3 handshake overhead on TCP. HTTP/3 (QUIC) did not collapse. Our measurements revealed a sustained success rate above 99.94% across every concurrency level we tested—a result we initially doubted and re-ran three times to confirm.  The cost of that resilience is real. We observed a throughput ceiling of 36–39 req/s for QUIC under new-connection load, which our analysis traces to per-connection 1-RTT handshake serialization inherent to QUIC's user-space UDP stack. We also report a memory footprint differential that surprised us: QUIC consumed roughly 440 MB RSS against gRPC's 37 MB under reuse workloads—a 12× gap that has practical implications for memory-constrained deployments. Taken together, these findings argue that protocol selection cannot be reduced to steady-state throughput alone; connection lifecycle semantics matter at least as much.