Nick Feamster created tools to explain networks and revealed their limits

Summary

• Nick Feamster is a professor at the University of Chicago, measurement researcher, institution builder and co-founder of NetMicroscope, focused on turning hidden Internet behaviours into accountable decisions.
• His rcc work found more than 1,000 previously undetected faults in 17 autonomous systems; Routing Control Platform helped establish a network control model later associated with SDN.
• Projects on spam, broadband, censorship and smart homes also showed limits: reputation can misclassify, remote probes create risk and encrypted metadata reveals behaviour.
• His current machine learning research asks whether conclusions can be efficient, auditable and safe in production; his contribution is collaborative systems that retain uncertainty.

Rcc: checking combined configuration before deployment

The 2005 paperDetecting BGP Configuration Faults with Static Analysis, co-authored with Hari Balakrishnan, introduced a configuration checker called rcc. It organised persistent faults into two broad classes. Path-validity faults occur when the control plane selects a route that does not match a usable data-plane path. Visibility faults occur when a valid path exists but the routers that need it do not learn it. The categories linked configuration commands to consequences recognisable by an operator.

rcc analysed configurations of multiple routers and checked network constraints. The paper reported 17 autonomous systems analysed, over 1,000 previously undetected faults and more than 65 downloads by operators. These are historical numbers declared by the authors. They do not prove that rcc became a universal product, and the available evidence does not indicate how many networks continued using it. They do establish that the project worked on real configurations and reached operators outside the laboratory.

The operational significance lies in the kind of test it produces. A checker can flag a configuration relationship that violates an invariant before an outage. It is different from a dashboard that reports packet loss after a service degrades. It gives an engineer a reasoned connection between a rule and a fault class. The result can support review, testing and conversation among teams that otherwise have only local views.

The limitations are equally instructive. rcc could only check properties encoded by its designers and supported by its analyser. It could not know an undocumented business intent, guarantee the absence of vendor defects or prevent a physical failure. Nor did it turn a clean configuration into proof that the network would never suffer a transient problem. A network can pass every written check and still fail a requirement that no one expressed.

That is why rcc belongs at the start of the profile. It set the ambition and the caution that recur later. The ambition was to make infrastructure behaviour calculable before harm. The caution was to recognise that correctness always depends on observed inputs and declared properties. Today’s AI systems for network operations face the same test, except the boundary may be harder to see when the model produces fluent explanations instead of explicit invariants.

The Internet often knows what it did, but cannot explain why

A packet reaches its destination or it does not. A video call stutters. A domain returns an unexpected address. A mail server rejects a connection. A smart speaker contacts a remote service at a revealing moment. Every event leaves traces, but the Internet lacks a central log that can provide a single, authoritative explanation. Its behaviour emerges from independently operated networks, vendor-specific configurations, private interconnection agreements, home equipment, application design and shifting demand.

That structure is useful because it prevents any single operator from controlling the whole system. It also makes diagnosis difficult. A router can show its own routes without explaining all the consequences of the combined policy. A speed test can measure a transfer without isolating Wi-Fi, access capacity, latency, interconnection and application effects. A censorship probe can observe a failed request without identifying the person or institution responsible. A traffic classifier can assign a label without proving it will remain correct when the network changes.

Feamster’s research history can be read as a series of attempts to narrow those gaps. The technologies change, but the operating method is recognisable. First, pick a hidden behaviour that matters. Then find an observation point where that behaviour leaves a measurable signal. Next, build a representation that turns the signal into a useful question for an operator, a policymaker or a user. Finally, test where the representation fails. This last step is essential: a system that offers a confident answer without showing its limits can make infrastructure less accountable instead of more understandable.

That is why Feamster is a figure of digital infrastructure even though he does not own fibre, operate a public autonomous system or run a hyperscale cloud. His work sits in the information layer around those assets. It influences how routes are verified, how abuse is identified, how broadband quality is described, how censorship is documented and how statistical models enter network operations. Routers and cables move traffic; measurement and analysis determine whether anyone can explain what they do.

The strongest narrative of that career is not a succession of awards nor a claim that one researcher invented several fields. It is the story of an observability programme that changed targets while keeping the same discipline: separate what is directly observed from what is inferred and separate an experimental result from an operational guarantee.

One career, several institutional identities

As of the research cut-off date of 3 August 2026, the University of Chicago identified Feamster as Neubauer Professor of Computer Science and Faculty Director of Research at the Data Science Institute. His personal page also listed him as director of the Network Operations and Internet Security Lab, co-director of the Internet Innovation Initiative, co-leader of netml.io and co-director of the AI and Policy Pillar. A Data Science Institute publication from September 2024 used the title Director of Technology Policy.

These descriptions can coexist because university roles overlap and evolve, but they should not be compressed into a single permanent title.

Institutional differences matter. As a professor, he researches and teaches. Through NOISE Lab and netml.io he works with students and collaborators on routing, measurement, privacy and machine learning. Through the Internet Innovation and Internet Equity projects he helps create evidence for public and infrastructure decisions. As co-founder and CEO of NetMicroscope he participates in a private company that seeks to commercialise network quality analytics. His biography also states he acts as an expert witness in technology litigation.

No role automatically transfers authority from another: a professor is not a regulator; a startup CEO does not convert university research into customer endorsement; an expert opinion is not a court ruling.

The separation matches the content of his work. Feamster’s best research asks what system preserves what evidence and what conclusion that evidence permits. The same care is needed when describing him. His current biography credits him with LookSmart’s first web crawler and a contribution to Damballa’s first botnet detection algorithm. These are useful, attributable data points about an early industry phase. They do not establish exact employment dates, sole authorship, equity stakes or the complete story of those products.

The public record is far richer about his professional work than about his private life. It does not reliably establish date or place of birth, citizenship, family background, compensation, stake in NetMicroscope, personal investments or wealth. A source-based profile must not convert those gaps into conjecture. The career is substantial enough without adding a celebrity biography the evidence does not support.

MIT, a web crawler and a thesis on failure before the failure

Feamster stayed at the Massachusetts Institute of Technology from undergraduate through doctoral studies. He earned an SB in electrical engineering and computer science in 2000, an MEng in the same field in 2001 and a PhD in computer science in 2005 under the supervision of Hari Balakrishnan. The thesis title,Proactive Techniques for Correct and Predictable Internet Routing, clearly states the initial programme. Instead of waiting for a routing failure to cause an outage and then reconstructing the cause, the network should expose enough structure to verify important properties before deploying changes.

His early work at LookSmart provides a useful, though limited, prelude. A web crawler must discover a large graph that changes while being watched. It finds broken links, duplicate pages, inconsistent responses and unreachable regions. The crawler did not directly turn into the later routing systems, and the sources do not support that claim. The relevant continuity is methodological: a distributed system is not visible from a single local view, so useful knowledge requires systematic collection and an explicit representation of what was found.

The Damballa connection added an adversarial version of the same problem. Botnets were designed to hide their membership and control. Feamster’s official biography says he helped design the company’s first botnet detection algorithm. The public evidence does not reconstruct the full team nor show how later products used that work. It does show that his early career crossed academic systems research and an operational security company that had to infer malicious coordination from network traces.

Doctoral research took shape in an environment where inter-domain routing policies were distributed across devices and organisations. Operators configured routers with commands expressing peering, customer relationships, export rules, backup routes and traffic engineering preferences. Each configuration could appear reasonable by itself while the combined network concealed a loop, a black hole or an undesired route. It was not merely a problem of flawed protocol implementation. It was the difficulty of reasoning about a distributed programme assembled from many local policies.

That framing became a lasting signature. Feamster frequently treated the operating system around an algorithm as the true unit of research: configuration files, measurement points, data pipelines, interfaces, operator incentives and institutional boundaries. The work expanded beyond a theorem or a classifier. It also raised the stakes: when a system touches real operators, homes or people under censorship, deployment and ethics become part of technical quality.

BGP configuration as a distributed programme

Border Gateway Protocol allows autonomous systems to exchange reachability information without giving up control of their business and routing policies. That autonomy partly explains how the Internet connects networks with different owners and goals. It also means that the global outcome is not designed by a single person. Policies are composed indirectly through announcements, preferences, filtering and internal route distribution.

Even within a single autonomous system the problem can be large. A network can have hundreds of routers and several mechanisms for distributing external routes internally. A route learned at an edge must be visible where it is needed, but not necessarily everywhere. The export policy must prevent a customer or peer route from being announced to the wrong neighbour. Backup routes must appear when the primary path fails without creating loops or persistent oscillations. The operator knows the business intent; the devices contain the executable fragments.

Feamster’s early work treated those fragments as an analysable programme. The shift in perspective was practical. A router configuration was no longer just text reviewed line by line but became input to a network-wide calculation. Correctness could be expressed as invariants: a chosen route must lead to a usable forwarding path; a usable path must be visible to the routers that need it; the export policy must preserve the intended relationships; internal distribution must not create persistent inconsistencies.

The analogy with software analysis was productive because it shifted the point of intervention. Traditional diagnosis starts after the symptom. Static analysis asks whether a known fault class is already encoded in the configuration. It does not need to inject traffic or wait for a complaint. For networks carrying critical services, moving a defect from the incident queue to the review queue can be worth more than shortening post-outage diagnosis.

The analogy has limits. A network’s state includes more than configuration: live routes, topology, vendor behaviour, transient convergence, hardware tables, broken links and business knowledge that may never have been written down. A static checker can be exactly correct about its model and miss a fault outside it. Feamster’s later research returned repeatedly to the difference between a useful representation and the whole operational world.

Routing Control Platform moved decisions out of individual routers

rcc asked whether a distributed configuration satisfied known constraints. Routing Control Platform raised a different question: why must each router independently reconstruct the information needed to choose routes? Traditional iBGP designs distributed external routes via a full mesh or reflectors. The mesh became unwieldy as the network grew. Route reflection reduced that cost, but could hide routes, produce unexpected choices and make the outcome less understandable.

The RCP paper proposed a logically centralised service that collected external BGP routes and internal topology, selected routes for each router and communicated decisions via ordinary iBGP. The forwarding devices did not disappear. They still carried packets and used a familiar protocol on the interface. What changed was the location of the selection logic and the view available to that logic.

‘Logically centralised’ did not mean a single fragile physical box. The service could be replicated and distributed while maintaining a coherent decision function. The distinction is also central to later software-defined networks. A controller can act from a network view without requiring every process to run on a single machine. The engineering problem becomes state consistency, failure recovery and interface security, not a choice between absolute centralisation and absolute distribution.

RCP also respected the installed infrastructure. It did not demand a new forwarding plane or immediately replace all routers. That deployment detail matters in networks whose hardware, contracts and procedures cannot change all at once. A research architecture gains practical value when it can enter production through an interface operators already know.

The evaluation used data from real backbone networks, but the sources do not offer a broad production census. The defensible claim is that RCP demonstrated a viable and influential architecture, not that it replaced internal iBGP across the industry. The 2015 NSDI Test of Time Award supports its lasting intellectual importance. It does not prove commercial adoption or grant one paper ownership of all later controllers.

A significant contribution to SDN, not a solo-inventor story

Software-defined networks are often told as a clean break: control moved to software, forwarding became programmable and a new era began. The real history is less tidy. Active networks, virtualisation, the 4D architecture, Ethane, RCP, OpenFlow, NOX and other projects tackled different pieces of programmability, control separation and global management. Feamster was a significant contributor to that trajectory, but no evidence permits calling him the sole inventor of SDN.

RCP provided a clear architectural idea: route decisions could be computed in a control service with a broader view and delivered to existing devices. rcc provided another: a network policy could be checked against invariants. Together they helped shift the question from ‘what command is on this router?’ to ‘what behaviour does the entire control system implement?’ That shift is one of the intellectual foundations of programmable networks.

Feamster later co-authoredThe Road to SDN, which presented the field as an accumulation of ideas rather than an instantaneous invention. This historical stance resists the founding myth that often grows around infrastructure technologies. A field emerges when multiple research groups, operators, vendors and standards communities solve neighbouring problems and make solutions deployable.

The 2017 agenda paperWhy (and How) Networks Should Run Themselves, with Jennifer Rexford, extended the argument from controller architecture to continuous operation. It described closed loops where high-level intent guides decisions, telemetry reveals effects and the system adapts. The title was provocative. It does not prove that engineers are no longer needed. A self-adjusting network still requires correct objectives, reliable telemetry, safe actuation, bounded permissions and a way to stop when evidence is ambiguous.

Today that agenda looks less like a distant vision and more like a design problem for AI-assisted operations. Language models can propose configurations, summarise incidents and choose tools. They can also invent causes, misinterpret policies or act with too much authority. The early routing work imposes a demanding rule: learned recommendations must be surrounded by explicit checks and observable consequences, not accepted because their explanation sounds convincing.

Spam made the network around the message more important than the message itself

At Georgia Tech the target of observation shifted from configuration errors to adversaries. Spam campaigns and botnets were designed to move. Compromised machines appeared and vanished, addresses changed, domains were swapped and control was distributed. A content signature could recognise a known message, but the delivery system often revealed a more durable pattern.

The 2006 SIGCOMM paperUnderstanding the Network-Level Behavior of Spammersanalysed, according to the work’s record, over ten million unwanted messages. It studied where senders appeared, how long they remained active and how spam, address space and routing related. Its importance does not lie in a permanent percentage. It showed that abuse could be studied as infrastructure: sender population, routes, time and source concentration could reveal coordination the text did not show.

The approach offered a practical advantage. Network features are available at the start of a connection, before accepting or inspecting a full message. They can reduce processing and enable large-scale action. They can also preserve some content privacy. But the same abstraction creates risk. A residential prefix can contain innocent users and compromised machines. Shared hosting can serve benign and harmful domains. An address can change hands. An infrastructure reputation is only useful if the system incorporates uncertainty, expiry and the possibility of appeal.

The counter-intelligence work with DNSBL exploited the attacker’s own defence. Botnet operators queried blocklists to see if their machines had been identified. Query patterns could signal likely members. The idea was elegant because it turned adversary reconnaissance into evidence. It remained a heuristic: a query could have a benign explanation and a list of likely bots needed corroboration before disruptive action.

SNARE turned spatiotemporal features available at the start of an SMTP session into a reputation score. Its evaluation reported approximately 93% accuracy with a low false positive rate. The number belongs to a specific dataset and threshold, not an eternal property. Spam infrastructure, providers and adversary tactics change. Operational utility demands fast updating, calibrated uncertainty and post-deployment error tracking.

DNS reputation extended the target from senders to domains. Malicious domains can show distinct patterns of registration, name servers, addresses and resolution. A system can assign risk before inspecting every payload. That idea anticipates today’s network machine learning: the category is inferred from structured metadata, and its value depends on resisting evasion, calibrating uncertainty and coping with drift.

Behavioural malware clustering added another layer. Instead of requiring an exact signature for each binary, it grouped samples by communication behaviour and produced network signatures. It works when code changes but the infrastructure or protocol keeps habits. It can also group unrelated traffic if the representation is too coarse. The common thread is not label certainty, but turning network behaviour into an operational hypothesis that still needs to be checked.

Reputation is an operational decision, not an objective label

Reputation systems connect measurement and action. They do not merely describe an address or a domain: they influence whether mail is accepted, a connection is blocked or an investigation is prioritised. Their quality depends, besides statistical accuracy, on who receives the score, the cost of a false positive, the speed of correction and whether the affected entity can understand or challenge the decision.

A compromised residential address illustrates the problem. Blocking it can reduce a spam campaign and simultaneously cut off a user who did not choose the infection nor know how to diagnose it. A reputation that lasts too long can punish the next subscriber. A reputation that is too short allows the attacker to return. The half-life of the score is therefore an infrastructure and governance decision, not just a model parameter.

This tension connects the security work with the later smart-home and machine learning projects. In each case, metadata is used to infer a hidden state. The closer the inference is to an automatic action, the more important it is to know origin, age, threshold and errors. An understandable explanation helps, but does not replace measuring consequences.

The patent record provides formal, limited proof. Feamster is listed among several inventors of a system for detecting and responding to attacking networks, assigned to Georgia Tech Research Corporation. The patent does not prove individual invention, product deployment, licensing revenue or the validity of all its claims after a challenge. It does show that the line of research was considered capable of commercial translation.

The editorial discipline is not to confuse detection with guilt. A reputation is an estimate under constraints. It can be very useful when the organisation treats error as a normal state to manage, not as an impossible exception. The same lesson returns in censorship measurement, device classification and contemporary AI models.

Measuring broadband from the gateway changed the observation point

Broadband complaints are easy to make and hard to diagnose. ‘The Internet is slow’ can refer to a limited access link, poor Wi-Fi, a busy home device, a congested interconnection, a distant server, application lag or a test unable to generate enough traffic. Measurements from a laptop inherit its software and local network. Measurements in the provider core do not see what the home experiences.

The gateway-based approach placed controlled measurement at the boundary between the home and the access provider. The 2011 SIGCOMM study used longitudinal data from almost 4,000 gateway devices across eight providers, within a deployment of over 4,200 units. It examined throughput, latency, access technologies and traffic shaping. The gateway’s value was analytical: it could observe the access service while avoiding some of the uncontrolled variation of an ordinary endpoint.

That observation point did not automate the answer either. The gateway shares the local environment with devices and Wi-Fi. The measurement server has its own path and capacity. Tests can compete with household traffic or run at unrepresentative times. The methodology improved attribution; it did not create a perfect view of user experience.

BISmark turned the method into a reusable platform. The 2014 USENIX ATC paper described custom routers and a central infrastructure capable of deploying measurements and applications. At the time of the work, it operated in hundreds of homes across about 30 countries and had been used by researchers from nine institutions. The numbers apply to that moment, but show an infrastructure that outgrew a single dataset.

Maintaining a home measurement platform is infrastructure work. Hardware must be shipped and supported. Users unplug devices. Firmware ages and clocks drift. Consent must remain comprehensible. and collection pipelines must survive network and application changes. The published system is therefore evidence of institution-building as well as measurement design.

The broadband programme also shows why method matters for public policy. A result from a controlled gateway is not interchangeable with a browser test, a provider counter or an advertised speed. Each measures a different part of the path. Public decisions are more defensible when the measurement position and its limits are visible rather than hidden behind a single speed figure.

When access links became faster, speed stopped explaining experience

Early broadband policy often asked whether the provider delivered the advertised speed. The question remains important, especially where capacity is scarce. It explains less when the connection is already fast enough and latency, Wi-Fi, content distribution or application design dominate the experience.

A study of over 5,000 networks examined web performance bottlenecks and found that, above a study-specific range, raw access throughput often ceased to be the only limiting factor. A faster subscription might not speed up a page if round-trip time, entity dependencies or the server controlled completion. The exact threshold should not be universalised. The lasting conclusion is that quality becomes multidimensional when access improves.

Reliability adds another dimension. A service can show a good median speed and fail households through brief interruptions. A video call, an exam or a remote medical consultation can be ruined by a short loss that vanishes in a monthly average. Longitudinal measurement is needed because a single test does not describe the frequency, duration and timing of failures.

Research on encrypted DNS exposed a similar trade-off. Resolver and protocol choices can affect latency, privacy and availability. In the measured panel, no single configuration was optimal for all users and networks. A security or privacy improvement can have a performance cost in one environment and not in another. The result cautions against turning a benchmark into a universal recipe.

Measurements during the COVID-19 pandemic showed how quickly the operating environment can change. Participating providers experienced abrupt traffic shifts and interconnection demand, followed by capacity expansions and usage changes. The conclusions were limited to the studied networks, but they demonstrated why planning based only on stable historical averages can fail during a social shock.

Here broadband measurement becomes quality-of-experience engineering. Operators must link low-level signals—throughput, latency, loss, interruptions and interconnection—to application outcomes such as video stalls and conference quality. That link later became the product thesis of NetMicroscope. Academic results do not validate every commercial claim, but the technical genealogy is direct.

Interconnection measurement turned a commercial dispute into a shared data problem

The path between a home and an application can cross several corporate boundaries. An access provider may exchange traffic directly with a content network, through an exchange point or via a transit provider. Congestion can appear on a specific link, in a specific direction and during a specific period. That is why public debates about ‘interconnection’ can mix technically distinct conditions.

The Interconnection Measurement Project asked participating providers to install a common tool on interconnection links. The project reported about 2,900 links and around 31% peak utilisation in June 2021, alongside capacity additions. Those aggregates do not prove that all user paths were free of congestion. An average can hide a brief peak, a particular route or a local fault. The project’s value was creating a shared methodology and vocabulary.

A common measurement can reduce one disagreement and create another. Entities must agree which links are included, how utilisation is sampled, how private data is protected and which summaries are released. Providers have commercial reasons to limit disclosures. Researchers need enough detail to check claims without exposing customer relationships or sensitive topology.

Feamster’s role is best described as building measurement capacity and institutional collaboration. He did not regulate contracts or compel participation. The project shows the step from an instrument in a home gateway to a shared evidence system with operators. The technical task was inseparable from governance: getting useful data required cooperation from the organisations that controlled the links.

Internet equity expanded performance toward access, affordability and reliability

A broadband line can exist in a neighbourhood and still be unaffordable. A household can subscribe to service and receive an unreliable connection. A provider can meet the advertised speed while Wi-Fi, building wiring or devices prevent an application from working well. Reducing the digital divide to a coverage map hides these differences.

The University of Chicago’s Internet Equity Initiative combines dimensions such as accessibility, infrastructure, affordability, adoption, performance and reliability. Its portals and projects bring together network measurements with demographic and public-policy data. Devices placed in Chicago homes provided direct evidence, while public sources allowed comparisons across places and populations.

The method can reveal patterns without explaining all causes. A neighbourhood difference can be associated with income, building type, competition, subscription level, equipment or historical investment. A demographic layer guides research; it does not prove why the difference exists. Policy work needs the same distinction as routing analysis: a representation makes a question testable, but does not replace missing variables.

UChicago communicated in 2025 that the Internet Innovation collaboration provided measurement and analysis to Illinois broadband planning linked to 175,000 underserved homes, businesses and community locations. It is a relevant institutional claim. The Illinois Broadband Lab, state officials and other partners participated. It should not be rewritten as if one professor personally connected 175,000 locations nor as proof that all planned construction was complete.

The progression from gateways to equity shows how the user of measurement changed. An operator can diagnose a line. A city can direct support based on a neighbourhood pattern. A state can use validated data in a funding process. The more measurement enters public decisions, the more it needs transparent definitions, versioned data and a clear account of uncertainty.

Censorship research turned observability into a human security question

Censorship is hard to measure for the same structural reason that makes routing hard to explain: the observer sees an outcome without necessarily seeing the mechanism. A request can fail due to state filtering, a local firewall, a DNS failure, an offline server, route instability or measurement error. The environments where evidence is most needed can be those where recruiting volunteers is most dangerous.

Infranet, published in 2002, first tackled censorship as an evasion problem. Cooperating web servers hid upstream requests inside ordinary HTTP activity and downstream data in images. Its assumptions belong to an earlier Web, but it established a lasting idea: censorship is also a dispute about which traffic patterns can be distinguished from normal communication.

Later work shifted from helping to cross a block to measuring the block itself. The transition opened a public-interest opportunity. Broad, repeatable measurements could document filtering not disclosed by governments or operators. It also created a harder ethical boundary: a system can produce evidence for the public and impose risk on the machine or person generating the signal.

This tension is not secondary in the career. It is the clearest case where making the Internet explain itself can harm people who never asked the question. The ethical quality of a censorship measurement depends on target selection, consent, frequency limits, retention, publication and the possibility of retaliation, not just statistical accuracy.

Encore showed how scale can outrun consent

Encore used cross-origin requests from browsers to test whether certain web resources were reachable across different networks. A participating site could trigger a request from a visitor’s browser, enabling inferences about whether the resource was blocked. The design promised scale without installing special software in each country.

The same mechanism created a serious ethical dispute. A person visiting a page unrelated to the study could become a measurement point without understanding the experiment. A request to a sensitive domain could be visible to a censor. A third-party site could appear responsible for probing unchosen material. The person taking the risk and the person receiving the data were not necessarily the same.

The independent paperNo Encore for Encore?argued that the design raised issues of informed consent, transparency, user safety and harm to third-party sites. It also documented communication with Feamster and system changes. The criticism should not be inflated into a finding of misconduct, nor reduced to a note erased by later work. It identified a real risk in a system built for a legitimate public purpose.

Feamster and Ben Jones later publishedCan Censorship Measurements Be Safe(r)?. The title treats safety as a continuum, not a binary certification. Coverage, repeatability and accuracy compete with the exposure of volunteers, targets and third parties. A measurement that reaches more networks can be less acceptable if it does not limit the risk imposed on each entity.

The episode changed the intellectual content of the research. Ethics stopped being an external review added to the method. The threat model had to include those generating traffic, the sites hosting tests and the authorities that could observe them. It is a lasting lesson for all distributed measurement, especially as browsers, home devices and AI agents become sensors.

Augur, Iris and later systems broadened reach without hiding risk

Augur attempted to infer connectivity between remote places via TCP/IP side channels without controlling a traditional measurement point at either end. The paper reported validation in nearly 180 countries over 17 days and included decisions aimed at not involving individual users. The approach broadened coverage, but relied on operating system behaviour, address selection, filtering asymmetry and statistical assumptions.

Iris focused on DNS manipulation. Repeated queries to resolvers could be compared across locations to detect anomalous responses. DNS provides structured evidence, but legitimate systems also cache, redirect, localise and filter. A response difference starts an attribution; it does not prove a specific government agency issued the rule.

Test-list construction became another source of bias. A programme that only probes globally known political sites can miss local languages and culturally specific subjects. In 2018, a project used language processing and search to find 1,125 sites missing from the largest then-available Chinese list. It improved coverage for that study, but remained a temporal artefact because domains, content and policies change.

GFWeb, published at USENIX Security 2024, measured the Chinese Great Firewall’s HTTP and HTTPS filtering over 20 months. The paper reported 1.02 billion domain tests and hundreds of thousands of registrable domains affected by distinct mechanisms. These are measurement counts, not a census of people. Their significance lies in showing that protocol-specific tests reveal different parts and that a single technique can undercount.

The Turkmenistan work reported 15.5 million domains tested, 122,000 censored domains identified and broader overblocking rules potentially affecting millions. It also explored evasion. Publishing a technique can help users and teach the censor what to block next. The timing of disclosure and local knowledge are therefore engineering decisions with human consequences.

Feamster’s contribution is substantial and collaborative. He co-authored systems, helped build communities and continues to teach Internet Censorship and Online Speech. He should not be presented as the sole founder of every related observatory, nor be credited for Geneva by mere thematic proximity. Mapping papers and roles is more accurate than applying a broad inventor label.

Measurement ethics became part of technical correctness

The censorship work offers a wider conclusion. A system can be statistically powerful and technically fail if it cannot be operated responsibly. Consent, target selection, query frequency, data minimisation and publication strategy determine whether the methodology can be repeated without unacceptable harm.

It does not demand eliminating all risk. Complete safety may be impossible when the target is a state or adversarial operator. It demands making the risk explicit, assigning it and comparing it to the intended public benefit. The most exposed people must not disappear behind a global domain count.

The principle also applies outside censorship. A broadband probe can reveal household habits. An IoT tool can collect metadata. A security reputation can deny service. A synthetic set can memorise traces it was meant to protect. Every measurement system creates new infrastructure with its own users, privileges and failure modes.

Feamster’s career is valuable precisely because it contains a documented dispute, not a perfect sequence. The Encore controversy shows how a method can be criticised, modified and followed by more explicit safety work. It also shows that later safeguards should not rewrite the original risk. A serious profile can acknowledge learning and keep the disagreement that made it necessary.

Smart homes showed what encryption does not hide

Encryption protects content, but the network still needs timings, sizes, flow directions and destinations to carry packets. A plug, a camera, a television or an assistant can contact predictable services with recognisable patterns. An observer who cannot read the message can infer that a device powered on, played video or notified an event.

A Smart Home Is No Castledemonstrated this side channel andSpying on the Smart Homeextended the analysis by evaluating traffic-shaping defences. That latter work reported that a constant-rate defence could protect activity with an overhead of approximately 40 kilobytes per second in the tested scenario. It is not a universal price of privacy. The device set, threat model, capability and concealment level change the trade-off.

The work corrected a common oversimplification. ‘Encryption in transit’ can be true and behaviour still exposed by metadata. A policy that speaks only of content can miss a relevant risk. Padding and shaping consume bandwidth, energy or latency, and the cost may fall on the home, not the manufacturer.

The practical question is not whether traffic analysis works in the laboratory. It is who observes the home, which inference is sufficiently reliable and which party can change the design. A provider, a local adversary, a manufacturer and a cloud service have different views. Measurement identifies the leak; consumer protection requires deciding on defaults, disclosure, redress and liability.

IoT Inspector became a consumer tool and research infrastructure

IoT Inspector moved the smart-home work from a controlled study to an open-source tool that users could run on their own networks. It allowed selecting devices, observing contacted destinations and, with consent, contributing labelled metadata to research. The 2020 paper documented thousands of users and tens of thousands of devices from numerous brands and categories.

Later reports used different totals—44,956, 54,094, over 55,000 or nearly 63,000 devices—because collection windows and conventions varied. Picking the largest number without a date would turn a shifting set into false precision. The important evidence is that the project reached a scale where user support, label quality, privacy and maintenance became first-order research problems.

A user-facing tool also reveals ambiguity. A domain can be shared among multiple cloud tenants. A device label can be wrong. A connection to a tracker does not by itself explain what data were sent or what harm occurred. Showing the destination can improve visibility without providing a practical remedy.

The team’s retrospective discussed incentives, consent, minimisation and operational maintenance. That record matters because an open platform can acquire obligations similar to a service provider. It stores sensitive evidence, depends on entities understanding the activity and must continuously communicate what its findings can claim.

Related studies on sampled IoT medical devices, connected toys and user perceptions extended the work toward consumer protection. Results must retain product, version and date. New firmware, vendor patching or a different deployment can alter the conclusion.

Network machine learning is a pipeline, not an isolated classifier

Machine learning entered Feamster’s work with spam and reputation long before the current generative cycle. The netml.io programme made the full pipeline explicit. A network classifier depends on how packets are represented, how labels are obtained, where features are computed, how long the model takes, how drift is detected and what action follows.

nPrint represented packets at the bit level in a standard format and nPrintML combined that representation with automated modelling. The goal was not to show that one representation works for every task, but to make comparisons more reproducible by reducing hidden feature-engineering changes.

Traffic Refinery studied the cost of extracting features at high speed. An accurate model is operationally poor if it drops packets, exhausts CPU or responds after the decision window has closed. LEAF examined concept drift: statistical relationships change as applications, devices and networks change. A production model needs criteria for retraining, rollback and error tracking per environment.

CATO combined predictive and systems objectives. Its NSDI 2025 evaluation reported, under specific experimental conditions, up to 3,600 times less inference latency and 3.7 times higher throughput without loss. These are not universal guarantees. Their conceptual importance is that statistical accuracy and packet-processing cost must be co-optimised.

Current work extends that logic to low-cost classification, queuing, probe selection, in-field L4S measurement and configuration analysis with language models. The 2005 thesis used explicit invariants; a 2026 model can infer a likely problem from examples and text. The new technique covers cases hard to formalise, but can substitute plausibility for proof if the recommendation is not checked against observable state.

Synthetic traffic tries to share useful data without revealing the real network

Real traces are hard to share. They can reveal communications, users, devices, organisational structure and proprietary applications. Labelling them is expensive and they age quickly. Synthetic data promise to generate packets and flows that preserve useful properties without publishing the original records.

NetDiffusion used diffusion models with protocol constraints to produce packet-level traffic. NetSSM added state and multiple flows. GATEAU, led by Feamster and Francesco Bronzino, frames the problem around privacy, collection cost and scarcity of labelled data. They seek a middle ground between random packets that are technically valid but unrealistic and authentic traces that cannot be safely distributed.

A generated trace can fail in several ways. It can preserve marginal statistics and lose correlations necessary for a task. It can memorise sensitive examples. It can respect syntax without reproducing congestion, session state or human behaviour. A classifier trained on it can perform well in the lab and fail in production.

The 2026 privacy and quality papers treat those risks as measurable rather than assuming ‘synthetic’ means anonymous. Privacy must be tested against plausible attacks and utility on the real task. Synthetic traffic is a research tool, not a certificate that the original network has vanished.

NetMicroscope tests whether the measurement programme can become a business

NetMicroscope is the clearest commercial translation of Feamster’s broadband and machine-learning research. The company identifies Feamster as CEO and co-founder, and Francesco Bronzino as CTO and co-founder. University commercialisation material says they founded it in 2021, with a remote team centred on Chicago and Lyon.

The product thesis is that throughput, latency, loss, device state and application signals are more useful when combined into an estimate of perceived quality. An operator can know a line is up without knowing why a video degraded. NetMicroscope claims to use machine learning to infer experience and spot problems before a complaint.

Verified financial evidence is limited. In January 2024, the George Shultz Innovation Fund awarded $200,000 to develop product, market, team and intellectual property. The company also participated in I-Corps and Compass. These are significant early commercial signals, but they do not prove valuation, total funding, revenue, customers, retention, share or profitability.

The university–company boundary deserves normal scrutiny, not innuendo. Classification papers can overlap with the product. Readers need to know affiliations, funding, data access, licensing and IP. The record does not show that all code from BISmark, nPrint or the university was exclusively transferred to the company.

The conclusion is modest: NetMicroscope tests whether years of research can become a service customers pay for. Public evidence verifies founders, orientation and a university grant. It does not yet support a claim of commercial dominance.

Teaching turned the research trajectory into an infrastructure curriculum

Feamster’s teaching follows the same progression as his research. At Georgia Tech he covered Internet architecture, security and next-generation networks, and later SDN. At Princeton he combined networks, information security and technology policy. His current Chicago courses include Machine Learning for Computer Systems, Internet Censorship and Online Speech and Security, Privacy, and Consumer Protection.

In 2020 he co-authored the sixth edition of Andrew Tanenbaum’sComputer Networks. His teaching page also credits him with creating and being the founding instructor of the networking course in Georgia Tech’s Online Master of Science in Computer Science. The course extended teaching far beyond one campus, although the founding claim should remain tied to that record unless an independent programme archive is cited.

The 2026 Quantrell Award provides independent institutional evidence that teaching is central. The announcement highlighted open problems, collaborative reasoning and exercises grounded in real work. Student comments are qualitative, but the award demonstrates that the career is not reduced to papers and companies.

Institutional building further widened the audience. Feamster directed Princeton’s Center for Information Technology Policy and later helped lead Chicago programmes linking measurement, public policy and data science. Workshops on free and open communications helped build a community where ethics and method could be debated together.

A fair account keeps collaborators visible. Many systems were implemented or led by students and early-career researchers. IoT Inspector, censorship projects, broadband platforms and ML systems have large teams. A professor can set direction and build institutions without being the sole author of every result.

Policy work provides evidence, but does not wield regulatory authority

Feamster’s public role starts from measurement. UChicago says he has worked with organisations such as the Federal Communications Commission and the city of Chicago. The equity and broadband projects can provide evidence on access, price, reliability and performance. They do not decide subsidy eligibility, regulate prices or order a provider to change its network.

The boundary matters because technical evidence gains authority when it enters government. A speed test can inform a proceeding, but legal criteria are set elsewhere. An interconnection graph can clarify utilisation, but contracts and routes remain outside. A censorship dataset can document interference without completing the legal or policy analysis.

Current AI privacy research extends the same problem to a new ecosystem. A Google Privacy Faculty Award supports work on third-party integrations in language-model systems. The user sees an interface while requests, context and inferred attributes circulate among plug-ins, APIs and services. The structure recalls the smart home: a visible product coordinates hidden data relationships.

The 2026 list includes research on implicit LLM inference, where the model deduces sensitive attributes even if the user provides no conventional identifier. That complicates minimisation. Removing names or numbers does not stop inferences about health, politics or demographics from an ordinary interaction.

The policy value lies in making the limits of evidence visible. A model, dataset or professor can inform a decision without owning it. Correct institutional use demands transparent methods, error estimates, versioned data and an explicit separation between what measurement shows and what an authority decides.

What the career has made visible and what remains hidden

In routing, spam, broadband, censorship, smart homes and machine learning, Feamster’s projects turned diffuse problems into evidence systems. rcc linked configuration and invariants. RCP gave route selection a wider view. Reputation systems inferred coordination from metadata. Gateways isolated pieces of performance. Censorship systems compared remote signals. IoT Inspector connected traffic to labels. NetML linked representation, cost and drift.

The systems did not make the Internet fully knowable. A clean check does not eliminate physical failures. A reputation does not prove guilt. A speed measurement does not explain affordability. A DNS anomaly does not identify an agency. Encrypted metadata does not reveal every action. A synthetic trace does not guarantee privacy. A language model does not become correct by producing a coherent diagnosis.

These limitations are not a reason to discard measurement, but to carefully design the system that uses it. Useful evidence must show origin, age, scope and uncertainty. High-impact actions need review, appeal or recovery. Researchers must distinguish results claimed by papers, institutions or independent reproduction. Commercial claims do not inherit academic authority without separate proof.

Feamster’s lasting contribution is building that middle layer between opaque infrastructure and decisions with consequences. His work helped operators, researchers, users and institutions ask better questions of systems that were not designed to explain themselves. The result is not certainty, but a more disciplined account of what was observed, what was inferred and what still requires judgement.