Nick Feamster: making networks explain themselves, and exposing the limits of measurement

Summary

• Nick Feamster is a professor at the University of Chicago, a network measurement researcher, institution builder, and co-founder of NetMicroscope, focused on turning hidden internet behaviour into accountable decision-making evidence.
• His rcc work discovered over 1,000 previously unrecognised faults in 17 autonomous systems; the Routing Control Platform helped establish a network-wide control model later associated with SDN.
• Spam, broadband, censorship, and smart home projects also reveal measurement boundaries: reputation judgements can misclassify, remote probing can create risks, and encrypted traffic metadata can still expose behaviour.
• His current machine learning research asks whether conclusions can be efficient, auditable, and secure in production environments; his core contribution is collaborative systems that preserve rather than erase uncertainty when using evidence.

Rcc: checking composite configurations before deployment

The 2005 paperDetecting BGP Configuration Faults with Static Analysis, co-authored by Feamster and Hari Balakrishnan, proposed the router configuration checker rcc. The paper classifies persistent faults into two categories. Route validity faults occur when the control plane selects a route that does not correspond to an available data-plane path; path visibility faults are when a usable path exists but the router needing it has not learned it. This classification links configuration commands to outcomes that operators can recognise.

rcc parses multiple router configurations and checks network-wide constraints. The paper reports analysing 17 autonomous systems, finding over 1,000 previously undetected faults, and being downloaded by operators more than 65 times. These are figures reported by the authors at the time; they do not prove rcc became a general industry product, nor confirm how many networks continued using it later. However, they demonstrate that the project was applied to real configurations and reached operators beyond the authors’ lab.

Its operational value lies in the type of evidence. The checker points out which set of configuration relationships violates an invariant before an outage occurs. This differs from dashboards that report packet loss only after service degradation. The engineer receives a reasoning chain from rule to fault category, usable for review, testing, and cross-team discussion.

Its limitations are equally important. rcc can only check properties that the designers encode and the parser supports; it cannot know undocumented business intent, cannot guarantee the absence of vendor defects or physical faults, and cannot turn a ‘clean configuration’ into proof that there will never be transient problems. A network can pass every written check and still violate an unexpressed requirement.

Thus rcc establishes both the ambition and the restraint that run through this article: the ambition to make infrastructure behaviour computable before it causes harm; the restraint to acknowledge that correctness is always relative to observed inputs and declared properties. Modern network ops AI faces the same test, except the boundary is harder to see when models offer fluent explanations rather than explicit invariants.

The internet usually knows what it did, but cannot explain why

A packet arrives at its destination, or it does not. A video call stutters. A domain returns an unexpected address. A mail server rejects a connection. A smart speaker contacts a remote service at a suggestive moment. Every event leaves traces, but the internet has no central ledger to give a single, authoritative explanation. Its behaviour emerges from independently operated networks, vendor-specific configurations, private peering agreements, home devices, application design, and ever-changing user demands.

This structure has important value because it prevents any one operator from controlling the whole system; it also makes diagnosis difficult. A router can show its own routes but cannot explain the full consequences of composite routing policies. A speed test can measure one transfer but cannot automatically separate Wi‑Fi, access capacity, latency, interconnection, and application factors. A censorship probe can observe a failed request but cannot necessarily identify the responsible person or institution. A traffic classifier can attach a label but cannot prove that the label remains correct after the network changes.

Feamster’s research can be understood as a sustained effort to close these knowledge gaps. The technologies change, but the method is stable: first, pick an important but hidden behaviour; second, find an observation point where it leaves a measurable signal; third, build a representation that translates the signal into questions an operator, policymaker, or user can ask; finally, test where the representation fails. The last step is indispensable, because a system that only gives confident answers without exposing its boundaries can make infrastructure less accountable, not more transparent.

Therefore, even though Feamster does not own fibre, operate a public autonomous system, or manage a hyperscale cloud, he remains an important research entity in digital infrastructure. His work occupies the information layer around those assets: how routing is checked, how abuse is identified, how broadband quality is described, how censorship is recorded, and how statistical models enter network operations. Routers and cables carry traffic; measurement and analysis determine whether people can explain what they are doing.

So the strongest narrative of this career is not a list of awards or a claim that one researcher invented multiple fields, but a continual observability programme that changes its entities while holding the same discipline: distinguish direct observation from inference, and experimental results from operational guarantees.

A career, multiple institutional identities

As of 3 August 2026, the University of Chicago lists Feamster as Neubauer Professor of Computer Science and Faculty Director of Research at the Data Science Institute. His own homepage also lists roles as director of the Network Operations and Internet Security Lab, co-director of the Internet Innovation Initiative, co-leader of netml.io, and co-director of the AI and Policy Pillar, among others. The Data Science Institute used the title Director of Technology Policy in a September 2024 article.

These descriptions can all be true simultaneously, because university roles overlap and evolve over time, but they cannot be compressed into a single permanent title.

Institutional boundaries matter. As a professor, he researches and teaches; through the NOISE Lab and netml.io, he works with students and collaborators on routing, measurement, privacy, and machine learning; through Internet Innovation and Internet Equity initiatives, he builds evidence for public policy and infrastructure decisions; as co-founder and CEO of NetMicroscope, he participates in a private company seeking to commercialise network quality analytics. His bio also states that he serves as an expert witness in technology litigation.

Each role does not automatically grant the authority of another: a professor is not a regulator; a startup CEO cannot turn university research into automatic customer endorsement; an expert opinion is not a court finding.

This distinction aligns with the research itself. Feamster’s best work asks: which system holds which piece of evidence, and what conclusion does that evidence support? The same care is needed when describing him. Current bios state that he wrote LookSmart’s first web crawler and helped design Damballa’s first botnet detection algorithm. These are attributable early industry facts, but they do not prove precise employment dates, sole authorship, equity stakes, or complete product histories.

Public sources are far richer on his professional work than on his private life. Available evidence cannot reliably confirm his date or place of birth, nationality, citizenship, family background, salary, NetMicroscope equity, personal investments, or wealth. An evidence-based article should not turn these gaps into speculation. His professional trajectory is important enough without adding a celebrity biography unsupported by sources.

MIT, a web crawler, and a thesis on ‘before the fault occurs’

Feamster attended Massachusetts Institute of Technology from undergraduate through PhD. He earned an SB in Electrical Engineering and Computer Science in 2000, an MEng in the same field in 2001, and a PhD in Computer Science in 2005 under Hari Balakrishnan. His dissertation,Proactive Techniques for Correct and Predictable Internet Routing, concisely captured the early research programme: rather than waiting for routing errors to cause outages and then reconstructing the cause, let the network expose enough structure to check critical properties before deployment.

The early work at LookSmart can serve as a limited but meaningful prelude. A web crawler must discover a large graph that changes continuously while being observed, confronting dead links, duplicate pages, inconsistent responses, and unreachable regions. The crawler did not directly turn into the later routing systems, and sources do not support such a claim. What really continues is the method: a distributed system cannot be seen clearly from a single local viewpoint, useful knowledge requires systematic collection, and an explicit representation of what has been discovered.

Damballa gave the same problem an adversarial twist. Botnets inherently try to hide their membership and control structure. Feamster’s official bio states that he helped design the company’s first botnet detection algorithm. Public materials cannot reconstruct the full team, nor prove how subsequent products used that work; but it shows that his early career moved between academic systems research and operational security companies that needed to infer malicious coordination from network traces.

The doctoral research took shape in a typical environment: inter-domain routing policy is fragmented across devices and institutions. Operators express peering, customer relationships, export rules, backup paths, and traffic engineering preferences in commands. Each device’s configuration may look reasonable in isolation, yet the composition can hide loops, black holes, or unintended paths. The problem is not merely flawed protocol implementations, but how to reason about a distributed program assembled from many local policies.

This framework became a long-term characteristic. Feamster often treats the complete operational system around the algorithm as the real research unit—configuration files, observation points, data pipelines, interfaces, operator incentives, and institutional constraints. The research thus goes beyond a single theorem or classifier and takes on greater responsibility: once a system touches real operators, households, or people living under censorship, deployment and ethics become part of technical quality.

Treating BGP configuration as a distributed program

The Border Gateway Protocol lets autonomous systems exchange reachability information while retaining control over business and routing policies. This autonomy enables networks with different owners and goals to form the internet, and it also means the global result is not designed by a single engineer. Policy is composed indirectly through route advertisements, preferences, filters, and interior route distribution.

Even within a single autonomous system, the problem can be large. A network may have hundreds of routers and several ways of propagating external routes internally. Routes learned at the edge must be visible where they are needed but not necessarily everywhere. Export policies must prevent customer or peer routes from leaking to the wrong neighbours. Backup paths should appear after a primary path fails but without creating loops or persistent oscillations. Operators hold the business intent; devices hold executable fragments.

Feamster’s early routing research treats these fragments as analysable programs. This is a practical shift in perspective: router configurations are no longer just text to review line by line, but inputs to a network-wide computation. Correctness can be written as invariants: the selected route should correspond to an available forwarding path; an available path should be visible to the router that needs it; export policies should preserve expected relationships; interior route distribution should not create persistent inconsistencies.

The value of the software-analysis analogy is that it shifts the time of intervention. Traditional troubleshooting starts after symptoms appear; static analysis asks whether a known fault class is already encoded in the configuration. It requires no traffic injection and no waiting for customer reports. For networks that carry critical services, moving defects from the incident queue to the review queue may be more valuable than shortening post‑mortem diagnosis.

Yet the analogy has boundaries. Network state is not just configuration; it includes live routes, topology, vendor behaviour, transient convergence, hardware tables, failed links, and business knowledge that may never be written down. A static checker can be completely correct with respect to its own model yet miss failures outside that model. Feamster’s later work repeatedly returns to this distinction: a useful representation is not the whole operational reality.

The Routing Control Platform moves decisions out of individual routers

rcc asks whether a distributed configuration satisfies known constraints. The Routing Control Platform asks something else: why should each router independently reconstruct the information needed to select paths? Traditional iBGP propagates external routes via full mesh or route reflectors. Full mesh becomes hard to maintain as scale grows; route reflection improves scale but can hide routes, produce unintended choices, and make overall behaviour harder to reason about.

The RCP paper proposes a logically centralised service: collect external BGP routes and interior topology, select paths for each router, and convey the choices via ordinary iBGP. The forwarding devices do not go away—they still forward packets and speak familiar protocols at interfaces; what changes is where the path-selection logic sits, and how much it can see.

‘Logically centralised’ does not mean a fragile physical box. The control service can be replicated and distributed while providing a consistent decision function. This distinction also became central to later SDN. A controller can act on a network-wide view without requiring all control processes to run on the same machine. The engineering problems shift to state consistency, failure recovery, and secure interfaces, rather than a simple binary choice between centralisation and distribution.

RCP also respects existing infrastructure. It does not require a new forwarding plane nor demand the immediate replacement of all routers. This matters for networks whose equipment, contracts, and operational processes cannot be changed all at once. A research architecture has greater practical value if it can enter a real environment through interfaces operators already know.

The evaluation used real backbone information, but available materials do not establish a census of broad production deployments. A defensible conclusion is that RCP demonstrated a feasible architecture and had lasting influence, not that it replaced interior BGP industry-wide. The 2015 NSDI Test of Time Award supports its idea value, but does not prove market adoption, nor can it credit all subsequent controller designs to a single paper.

Important contributions to SDN, not a ‘sole inventor’ story

Software-defined networking is often told as a clean break: control moves into software, forwarding becomes programmable, a new era begins. The real history is less neat. Projects such as active networks, network virtualisation, the 4D architecture, Ethane, RCP, OpenFlow, and NOX dealt with different pieces of programmability, control separation, and network-wide management. Feamster is an important contributor in this lineage of ideas, but there is no evidence to support calling him the sole inventor of SDN.

RCP provides one clear architectural idea: a control service with a wider view can compute routing decisions and hand them to existing forwarding devices. rcc provides another: network policies can be checked against invariants. Together, they shift the operational question from ‘what commands are on this router’ to ‘what behaviour does the whole control system implement’. This is an important conceptual foundation for programmable networks.

Feamster later co-authoredThe Road to SDN, which describes the field as a long accumulation of ideas rather than a single flash of invention. This historical stance helps resist the founder myths that commonly surround infrastructure technology. A field usually emerges from multiple research teams, operators, vendors, and standards communities solving adjacent problems and making them deployable.

The 2017 paper with Jennifer Rexford,Why (and How) Networks Should Run Themselves, extends the argument from controller architecture to continuous operation. It sketches a closed loop in which high-level intent guides decisions, telemetry shows results, and the system adjusts accordingly. The title is deliberately provocative, but it cannot be read as meaning engineers are no longer needed. An adaptive network still requires accurate objectives, trustworthy telemetry, secure execution, limited authority, and mechanisms to stop when the evidence is unclear.

Today, this agenda looks more like a design problem for AI-assisted operations. Language models can suggest configurations, summarise incidents, and select tools, but they can also fabricate causes, misunderstand policy, or possess excessive authority. The early routing research set a strict standard for new systems: learned suggestions must be surrounded by explicit checks and observable consequences, not accepted merely because the explanation sounds plausible.

Spam makes the network around the message more important than the message itself

At Georgia Tech, the entity of observation shifted from configuration mistakes to active adversaries. Spam campaigns and botnets inherently move: infected hosts appear and disappear, addresses change, domains are substituted, and control infrastructure is scattered. Content signatures can catch known messages, but the delivery system often shows more persistent patterns.

The 2006 SIGCOMM paperUnderstanding the Network-Level Behavior of Spammersanalysed, according to the paper, over 10 million spam messages. It examined where senders appear, how long they persist, and how spam relates to address space and routing behaviour. The paper’s importance is not a particular permanent ratio, but its demonstration that abuse can be studied as infrastructure: sender populations, paths, timing, and source concentration can reveal coordination invisible in the body text.

Network-level features can be available early in a connection, before the full message is received or inspected. This can reduce processing and support large‑scale defence, and may protect some content privacy by using metadata. But the same abstraction creates risks. Residential address prefixes may contain both innocent users and infected devices; shared hosting may serve both legitimate and malicious domains; addresses change ownership. Infrastructure reputation is useful only when uncertainty, evidence decay, and appeal mechanisms are built into the system.

DNSBL counter-intelligence uses the attacker’s own defensive behaviour as a signal. Botnet operators query DNS blacklists to check whether a machine has been identified; particular query patterns can therefore reveal membership. The attacker’s reconnaissance becomes evidence, but it remains a heuristic: queries can have legitimate reasons, and a suspect list needs further corroboration before disruptive action is taken.

SNARE scores senders using spatial, temporal, and network features available early in an SMTP session. The evaluation reported approximately 93% accuracy at a low false-positive rate. That number belongs to the dataset, threat landscape, and threshold of its time; it does not remain static for 17 years. Attackers adapt, email infrastructure concentrates, and feature distributions drift. It proves that early signals can support a useful classifier, not that they establish a permanent benchmark.

Dynamic DNS reputation systems extend the same logic from senders to domains. Registration patterns, name servers, address changes, and resolution behaviour can make malicious infrastructure look different from stable legitimate services. A classifier can assign risk before seeing the full payload. This foreshadows later network machine learning: build a representation from metadata, train a decision rule, and then handle the operational consequences when the representation is incomplete.

Reputation is an operational decision, not an objective label

HTTP‑based malware behaviour clustering pushes the method further. Instead of requiring an exact signature for every binary, it groups by communication behaviour and generates network signatures. This approach can still work when code changes but control protocols, destination patterns, or timing behaviour persist; if the representation is too coarse, it can also group unrelated traffic together.

The distinction between signal and decision determines how a system should be used. A model can report that an address, domain, or flow resembles known abuse, but an operator still decides what to do next: a low-confidence result might trigger only observation, a stronger result might trigger rate‑limiting. Blocking an entire prefix or domain imposes costs on innocent users. Therefore, the technical design also includes thresholds, evidence age, scope of action, and a correction path.

Feamster’s early Damballa work and a patent assigned to Georgia Tech Research Corporation indicate a commercial and IP context for this line of research. The patent lists Feamster, David Dagon, Wenke Lee, and others as inventors of a method for detecting and responding to attack networks. A patent establishes a formal record of inventorship and assignment, but does not prove independent creation, productive use, licensing revenue, or the validity of every claim in every jurisdiction.

The broader contribution is treating reputation as an infrastructure problem, not merely an abstract accuracy figure. Defenders need classifiers that run within the decision window, at line rate, using data that can be legally collected, and that can manage errors. A paper can optimise one link in the chain; a production system must carry the whole chain over years while the adversary changes.

This also connects to Feamster’s current machine learning research, which deals more explicitly with feature cost, drift, privacy, and deployment. The fundamental question remains: when network signals are turned into decisions, what evidence makes them reliable enough to affect real traffic?

Measuring broadband from the home gateway changed the observation point

Broadband complaints are easy to voice but hard to diagnose. ‘The internet is slow’ could mean a constrained access link, poor Wi‑Fi, a busy home device, interconnection congestion, a distant server, application latency, or a test that cannot generate traffic fast enough. Measurements on a laptop inherit the computer’s software and local network conditions; measurements inside the operator’s core network cannot see the actual home experience.

The gateway‑based approach places controlled measurement at the boundary between the home and the ISP. The 2011 SIGCOMM study used longitudinal data from eight ISPs and nearly 4,000 gateways, drawn from a larger deployment of over 4,200 devices. The study analysed throughput, latency, access technology, and traffic‑shaping behaviour. The analytical value of the gateway is that it observes the access service while avoiding some of the uncontrolled variation of ordinary end devices.

This observation point still does not automatically yield answers. The home gateway shares the local environment with devices and Wi‑Fi; measurement servers have their own paths and capacity; tests can interfere with household traffic and may run at unrepresentative times. The method improves attribution but does not create a perfect view of user experience.

BISmark turned the gateway method into a reusable testbed. The 2014 USENIX ATC paper described custom routers and a backend capable of deploying measurements and applications. At the time of publication, the platform operated in hundreds of homes across about 30 countries and was used by researchers from nine institutions. These numbers belong to a specific moment, but they show the project moved beyond a one‑off dataset.

Maintaining a home testbed is infrastructure work in itself: hardware must be shipped and supported, users unplug devices, firmware ages, clocks drift, informed consent must remain continuously understandable, and data structures and collection pipelines must survive network and application changes. A public system therefore simultaneously demonstrates measurement design and institution‑building capability.

The broadband research also shows why method matters for policy. Controlled gateway results are not interchangeable with browser speed tests, ISP counters, or advertised plans—they measure different parts of the path. Only when the observation point and boundaries are publicly visible can a public decision be more defensible than one hidden behind a single ‘top speed’ number.

Once access links became fast, speed alone no longer explained experience

Early broadband policy often focused on whether operators delivered the advertised speed. That remains important where access capacity is scarce. But once connections became fast enough, latency, Wi‑Fi, content distribution, and application design began to dominate experience, and a single speed figure loses explanatory power.

A study covering more than 5,000 broadband networks examined web performance bottlenecks and found that, past the study’s specific ranges, raw access throughput was often no longer the sole constraint. If round‑trip latency, page‑entity dependencies, or server behaviour dictate completion time, a faster plan does not necessarily make the page feel faster. The specific thresholds cannot be universalised; the lasting conclusion is that once access improves, quality becomes a multi‑dimensional problem.

Reliability adds another dimension. A service can have a good median speed yet be unusable for a household because of short outages. A video call, an exam, or a telehealth session can be disrupted by a brief loss that disappears in a monthly average. A single test cannot describe failure frequency, duration, or time of day, so longitudinal measurement is needed.

Encrypted DNS research showed similar trade‑offs. The choice of resolver and protocol changes latency, privacy, and reachability. In the tested panel, no single configuration suited all users and networks. A security or privacy gain can carry a performance cost in one environment and none in another, so a benchmark should not become a universal prescription.

COVID‑era measurement showed how abruptly the operating environment can change. Participating ISPs experienced sudden shifts in traffic and interconnection demand, then added capacity and settled into new usage patterns. The conclusions apply only to the networks measured, but they illustrate that planning based solely on steady historical averages fails under a societal shock.

Here, broadband measurement turns towards quality‑of‑experience engineering. Operators need to connect low‑level signals—throughput, latency, loss, outages, interconnection—to application outcomes such as video stalling and conference quality. This line of thinking later became part of NetMicroscope’s product positioning. Academic results do not prove every commercial claim, but the technical lineage is clear.

Interconnection measurement turns commercial disputes into a shared data problem

The path from home to application can cross multiple commercial boundaries. An access provider may exchange traffic directly with a content network or via an internet exchange point or transit provider. Congestion can appear on just one link, in one direction, and at certain times. The ‘interconnection problem’ in public debate can therefore mix many technical states.

The Interconnection Measurement Project asked participating ISPs to deploy common tools on interconnection links. The project reported about 2,900 links, with peak utilisation around 31% in June 2021, and documented capacity additions. Aggregate results cannot prove that every user path is free of congestion; link averages can hide short‑term peaks, individual routes, or local faults. The project’s value lies in attempting to give multiple parties a common method and language.

A shared measurement system reduces one kind of disagreement while creating another. Entities must agree which links to include, how to sample utilisation, how to protect proprietary data, and which summaries may be made public. Providers may have commercial reasons to limit disclosure; researchers need enough detail to test claims without exposing customer relationships or sensitive topology.

Feamster’s more precise role here is building measurement capability and institutional cooperation. He did not regulate interconnection contracts, nor did he force companies to participate. The project illustrates how his research evolved from instrumentation on home gateways to an evidence system shared with operators. The technical task and governance are inseparable: useful data depends on cooperation from the institutions that control the links.

Internet equity extends performance to access, affordability, and reliability

A community may already have broadband lines, but the price still makes them unaffordable for a household; a family may have subscribed to a service yet face persistently unreliable connections; an operator may deliver the advertised speed, but Wi‑Fi, building wiring, or end‑device quality still leaves applications unusable. Reducing the digital divide to a coverage map obscures these differences.

The University of Chicago’s Internet Equity Initiative brings together availability, infrastructure, affordability, adoption, performance, and reliability. Its portal and projects combine network measurement with demographic and policy data. Devices in Chicago homes provide direct evidence of service performance, while public datasets enable comparisons across places and groups.

The method can reveal patterns but cannot automatically explain every cause. Community differences may correlate with income, building type, operator competition, plans, devices, or historical investment. Overlaying demographic data can drive investigation, but cannot alone prove why a disparity arose. Policy research needs the same discipline as routing research: a representation makes the question testable but does not substitute for missing variables.

UChicago reported in 2025 that Internet Innovation collaborative projects contributed measurement and analysis to the Illinois broadband plan, which concerns 175,000 underserved households, businesses, and community anchor points. This is an important institutional statement, involving the Illinois Broadband Lab, state government staff, and other partners. It must not be rewritten as a single professor personally connecting 175,000 locations, nor can it be treated as proof that all planned construction has been completed.

From gateway tests to internet equity, the intended users of measurement also change. An operator can use gateway results to diagnose a line; a city can use neighbourhood patterns to decide where to direct assistance; a state government can use verified data in funding challenge processes. The deeper measurement enters public decisions, the greater its impact, and therefore the greater the need for transparent definitions, versioned data, and clear statements about remaining uncertainty.

Censorship research makes observability a personal safety issue

Censorship is hard to measure for the same structural reason that routing is hard to explain: the observer sees the product of many systems acting together. A failed domain resolution could come from state filtering, a local firewall, an ordinary DNS error, a server outage, or routing instability. A connection reset could be injected, come from the endpoint, or be caused by middleboxes unrelated to political control. Signals rarely come with a signed attribution statement.

The risk differs because measurement can expose a person. Researchers need observation points inside the censored network, yet volunteers can face retaliation. Remote techniques can reduce the need to recruit local entities, but they can also involve users, websites, or systems that never consented to the experiment. In this domain, the security model is part of the measurement architecture.

Feamster’s relevant work begins with Infranet in 2002. The system treats censorship as an evasion problem: cooperative web servers encode covert upstream requests in seemingly ordinary HTTP activity and hide downstream information inside images. Its web assumptions belong to an earlier technical era, but it establishes a lasting theme: censorship is in part an adversarial game about which traffic patterns can be distinguished from normal communication.

Subsequent research shifted from helping users cross blocks to measuring the blocks themselves. Large‑scale, repeatable measurement can document filtering that governments or network operators do not disclose, and has public interest value; but it also creates a harder ethical boundary: a system that generates evidence for the public can impose risks on the specific devices that produce the signal.

This is not a minor controversy in the career but the clearest example of how ‘making the internet explain itself’ can harm people who never asked the question. The ethical quality of censorship measurement therefore depends on target selection, consent, rate‑limiting, data retention, disclosure, and the likelihood of retaliation—not merely on statistical accuracy.

Encore shows how scale can bypass informed consent

Encore uses browser cross‑origin requests to test the reachability of selected web resources from different networks. Participating websites can cause visitors’ browsers to make requests, and researchers infer whether a resource is blocked. The design promises scale without deploying dedicated software in every country.

The same mechanism raised serious ethical concerns. People visiting unrelated pages could become measurement points without understanding the experiment; requests to sensitive domains could be seen by censors; third‑party websites could appear to be probing content they did not choose. The people bearing the risk were not necessarily the same as the researchers obtaining the data.

The independent paperNo Encore for Encore?identified problems with the design around informed consent, transparency, user safety, and harm to third‑party websites, and documented communication with Feamster and modifications to the system. The criticism should be neither exaggerated into a formal finding of academic misconduct nor minimised as a footnote erased by later work. It identified real design risks in a system that pursued a legitimate public goal.

Feamster and Ben Jones subsequently publishedCan Censorship Measurements Be Safe(r)?. The title correctly treats safety as a continuum, not a binary certification. Coverage, repeatability, and accuracy are traded off against the exposure of volunteers, targets, and bystanders. A system that covers many networks is not necessarily more acceptable if it cannot bound the risk each entity bears.

This episode changed the intellectual content of the research. Ethics is no longer an external review attached to a technical method but must enter the threat model: the people generating traffic, the institutions hosting tests, and the authorities that may observe the flows are all part of the architecture. This is a lasting lesson for all infrastructure measurement that treats browsers, home devices, and AI agents as distributed sensors.

Augur, Iris, and subsequent systems extend coverage without hiding risk

Augur sought to infer connectivity between remote locations through TCP/IP side‑channels, without controlling traditional measurement points at either end. The paper reported validation across nearly 180 countries within 17 days and included design choices intended to avoid involving individual users. The method expands geographic reach, but the inferences depend on operating‑system behaviour, address selection, filtering asymmetry, and statistical assumptions.

Iris focuses on DNS manipulation. Repeatedly querying resolvers at different locations and comparing answers can identify anomalous responses. DNS provides structured evidence, but legitimate systems also cache, redirect, localise, and filter. Response differences are merely a starting point for attribution, not proof that a specific government body issued the rule.

Test‑list construction is also a source of bias. Projects that probe only globally famous political websites can miss issues specific to local language and culture. A 2018 project used natural language processing and search to find 1,125 websites missing from the largest Chinese blocklist at the time. The expanded list improved coverage for that study, but it remains a time‑bound artefact that ages as domains, content, and policies change.

GFWeb, published at USENIX Security 2024, studied HTTP and HTTPS filtering by China’s Great Firewall continuously for 20 months. The paper reports testing 1.02 billion domains and identifying hundreds of thousands of pay‑level domains affected by different mechanisms. These are measurement counts, not an affected‑population census. The value lies in showing that testing different protocols reveals different parts of the filtering system, and a single technique can undercount.

The Turkmenistan study reports testing 15.5 million domains, identifying 122,000 censored domains, and inferring overblocking rules that could affect millions of other domains, while also studying circumvention methods. Publishing circumvention techniques can help users but can also teach censors what to block next. The timing of disclosure, and local knowledge, therefore become engineering decisions with real human consequences.

Feamster’s record in this area is significant and highly collaborative. He co‑authors systems, helps build the research community, and continues to teach Internet Censorship and Online Speech. He should not be called the sole founder of every related observation project, nor should Geneva be attributed to him, just because the topic or collaborators are close. Mapping papers and roles project by project is more accurate than using a blanket inventor label.

Measurement ethics becomes part of technical correctness

Censorship research raises a broader observability principle. A system can be statistically powerful yet technically fail because it cannot be run responsibly. Informed consent, target selection, query frequency, data minimisation, and publication strategy together determine whether a method can be repeated without causing unacceptable harm.

This is not a demand that researchers eliminate all risk. Absolute safety may not exist when facing adversarial states or network operators. The requirement is to make risks explicit, allocated, and compared against the expected public benefit. The people bearing the greatest risk should not disappear behind totals of global domain names.

The same principle applies beyond censorship. Broadband probes can expose household activity patterns; IoT tools can collect device metadata; security reputation scores can deny service; synthetic datasets can remember real traces that should have been protected. Every measurement system creates new infrastructure, with its own users, permissions, and failure modes.

Feamster’s career history is valuable precisely because it includes a documented controversy, not a seamless sequence of successes. The Encore controversy shows that methods can be criticised, modified, and lead to more explicit safety work; it also shows that later protections cannot retroactively rewrite the initial risks. A serious article can acknowledge learning while preserving the disagreements that prompted it.

Smart homes show what encryption cannot hide

Encryption protects the payload, but networks still depend on timing, packet size, direction, and destination to deliver traffic. Smart plugs, cameras, televisions, or voice assistants can contact predictable services in recognisable patterns. An observer who cannot read the messages can still infer that a device powered on, started playing video, or reported an event.

A Smart Home Is No Castledemonstrated such side‑channels, andSpying on the Smart Homefurther evaluated traffic‑shaping defences. The latter reported that, in its test environment, a constant‑rate defence could hide activity with about 40 kilobytes per second of additional traffic. That figure is not a universal privacy cost; the mix of devices, threat model, link capacity, and the desired level of concealment all change the trade‑off.

The study corrects a common simplification in consumer privacy. ‘Encrypted in transit’ can be true while behaviour is still exposed through metadata. A privacy policy that discusses only content can therefore miss significant risks. Traffic shaping and padding consume bandwidth, energy, or latency, and the cost may fall on the household rather than the manufacturer.

The practical question is not whether traffic analysis can be done in a lab, but who can observe the home, which inference is reliable enough to act upon, and which party can change the design. ISPs, local attackers, device manufacturers, and cloud providers have different vantage points. Measurement discovers leaks; consumer protection still needs decisions about defaults, disclosure, remedies, and liability.

IoT Inspector becomes a consumer tool and research infrastructure

IoT Inspector moved smart‑home research from controlled experiments to an open‑source tool users can run on their own networks. Entities can select devices, see what destinations they contact, and, with consent, contribute labelled metadata for research. The 2020 paper recorded thousands of users and tens of thousands of devices from many vendors and categories.

Subsequent reports used different totals—44,956, 54,094, over 55,000, or about 63,000 devices—because collection windows and counting conventions differed. Picking only the largest number without a date turns a changing dataset into false precision. What really matters is that the project reached a scale where user support, label quality, privacy, and software maintenance became first‑class research problems.

A consumer‑facing inspection tool also exposes ambiguity. A domain may be shared by many cloud customers, device labels can be wrong, and a connection to a tracker does not itself say what data was transmitted or what harm resulted. Showing destinations can increase visibility but does not necessarily give users a practical remedy.

The project team’s retrospective discussed incentives, consent, data minimisation, and operational upkeep. This record matters because an open research platform can take on obligations similar to a service provider: safeguarding sensitive evidence, relying on entity understanding, and continuously explaining what the research findings can and cannot prove.

Related work on sampled medical IoT devices, connected toys, and user privacy perceptions extends the work into consumer protection. Conclusions must be tied to specific products, versions, and dates. Firmware updates, vendor fixes, and different deployments can all change the results.

Network machine learning is a pipeline, not an isolated classifier

Machine learning entered Feamster’s work long before the current generative AI cycle, via spam and reputation research. The later netml.io initiative explicitly presents the full pipeline around the classifier: how packets are represented, how labels are obtained, where features are extracted, how fast the model runs, how drift is detected, and what action follows.

nPrint represents packets in a standardised bit‑level format, and nPrintML combines that representation with automated modelling. The goal is not to prove one representation fits all tasks, but to reduce hidden variation in feature engineering and make comparisons more reproducible.

Traffic Refinery studies the system cost of generating features at high data rates. If feature extraction drops packets, exhausts the CPU, or returns results after the decision window has closed, the statistically accurate model is still operationally poor. LEAF studies concept drift—the shift in statistical relationships as applications, devices, and networks change. Production models need retraining criteria, rollback procedures, and per‑environment error monitoring.

CATO jointly optimises prediction and system objectives. Its NSDI 2025 evaluation reported, under specific experimental conditions, up to a 3,600× reduction in inference latency and a 3.7× increase in lossless throughput. These are not general production guarantees. The conceptual point is that statistical accuracy must be co‑optimised with packet‑processing cost.

Current work extends this logic to low‑cost classification, queues, probe selection, L4S live measurement, and using language models to analyse misconfigurations. The 2005 paper relied on explicit invariants; a 2026 language model can infer a ‘likely’ problem from examples and text. New methods can cover situations that are hard to formalise, but they can also substitute plausibility for proof if the suggestion is not cross‑checked against observable network state.

Synthetic traffic tries to share useful data without exposing real networks

Real traffic traces are hard to share. They can leak communications, users, devices, organisational structures, and proprietary applications; labels are expensive, and traces age quickly. Synthetic data proposes an alternative: generate packets and flows that preserve useful properties while not disclosing the original records.

NetDiffusion uses diffusion models with protocol constraints to generate packet‑level traffic; NetSSM adds state and multi‑flow awareness. GATEAU, led by Feamster and Francesco Bronzino, frames the broader problem as a relationship between privacy, collection cost, and labelled‑data scarcity. These projects hope to find a middle ground between ‘technically valid but unrealistic random packets’ and ‘real traffic traces that cannot be safely shared’.

Generated traces can still fail in many ways. They may preserve marginal statistics yet lose the correlations downstream tasks need; they may memorise sensitive examples; they may meet protocol syntax but not reproduce congestion, session state, or user behaviour. A classifier trained on them can succeed in tests and fail on production traffic.

The 2026 work on privacy–quality trade‑offs treats these risks as testable entities, not assuming that ‘synthetic’ equals anonymous. That is the right standard. Privacy needs testing against plausible attacks; utility must be measured on the intended tasks. Synthetic traffic is a research tool, not proof that the original network has disappeared.

NetMicroscope tests whether a measurement programme can become a business

NetMicroscope is the clearest commercial translation of Feamster’s broadband and machine‑learning research. The company lists Feamster as CEO and co‑founder, and Francesco Bronzino as CTO and co‑founder. University commercialisation materials state that the two founded the company in 2021, with a distributed team centred on Chicago and Lyon.

The product proposition is that combining throughput, latency, loss, device state, and application signals into an estimate of quality of experience is more useful than isolated metrics. An operator may know a line is up, but not why video is degrading. NetMicroscope says it uses machine learning to infer application experience and detect problems before users complain.

Verifiable financial evidence is limited. In January 2024, the George Shultz Innovation Fund provided $200,000 to the company for product, market, team, and IP development. The company has also participated in I‑Corps and Compass accelerators. These are meaningful early commercial signals, but they do not prove valuation, total funding, revenue, customer count, retention, market share, or profitability.

The boundary between university and company should face ordinary scrutiny, not insinuation. Papers related to traffic classification may overlap with a commercial product, and readers need to know about the researcher’s company ties, funding, data access, licensing, and IP assignment. Available materials do not prove that BISmark, nPrint, or all of the university’s code was exclusively transferred to the company.

NetMicroscope therefore supports a restrained conclusion: it is testing whether years of measurement research can become an operational service customers will pay for. Public evidence confirms the founders, product direction, and a university fund award, but is not yet enough to claim commercial dominance.

Teaching turns a research trajectory into an infrastructure curriculum

Feamster’s teaching record evolves along the same path as his research. At Georgia Tech, courses covered internet architecture, security, and next‑generation networks, later adding software‑defined networking; at Princeton, the focus combined networks with information security and technology policy; current UChicago courses include Machine Learning for Computer Systems, Internet Censorship and Online Speech, and Security, Privacy, and Consumer Protection.

In 2020 he co‑authored the sixth edition ofComputer Networkswith Andrew Tanenbaum. His teaching page also states that he created and served as the founding instructor for the computer networking course in Georgia Tech’s Online Master of Science in Computer Science programme. The online course extended networking education to an audience far beyond a single campus class, though, in the absence of a stand‑alone programme archive, this founding claim should remain tied to his public teaching record.

The 2026 Quantrell Award provides independent institutional evidence that teaching is a significant part of his career. UChicago’s announcement emphasises open questions, collaborative reasoning, and exercises designed around real work. Student evaluations are qualitative, but the award shows this career cannot be compressed into papers and startups.

Institution building further extends the audience. Feamster formerly led the Princeton Center for Information Technology Policy and later helped UChicago create programmes linking network measurement, public policy, and data science. Workshops around free and open communication have also fostered a community where ethics and measurement design can be discussed together.

A fair narrative must keep collaborators visible. Many systems were implemented or led by students and junior researchers. IoT Inspector, censorship projects, broadband testbeds, and machine‑learning systems all have large, multi‑author teams. A professor can set direction and build institutions, but that should not turn him into the sole author of every result.

Policy work provides evidence but does not exercise regulatory authority

Feamster’s public‑policy role rests on measurement. UChicago says he has worked with bodies such as the Federal Communications Commission and the City of Chicago. The Internet Equity and broadband projects can supply evidence about availability, affordability, reliability, and performance, but they do not decide subsidy eligibility, regulate prices, or order operators to modify their networks.

This boundary matters, because technical evidence acquires authority once it enters a government decision. Speed tests can support a challenge process, but legal standards are set by other bodies; an interconnection map can show utilisation but does not control contracts or routing decisions; a censorship dataset can record interference but has not completed a legal or political analysis.

Current AI privacy research brings the same question into a new ecosystem. The Google Privacy Faculty Award supports work on third‑party integrations in language‑model systems. A user may see only one interface, while prompts, context, and inferred attributes flow among plugins, APIs, and remote services. This is structurally similar to the smart home: a single visible product orchestrates multiple hidden data relationships.

A 2026 publication list also includes work on ‘implicit LLM inference’: models can infer sensitive attributes even when a user has not provided traditional identifiers. This makes data minimisation harder. Removing a name or account number does not stop a model from inferring health, political, or demographic information from ordinary interactions.

The policy value of this work lies in making evidence boundaries visible. A model, dataset, or professor can inform a decision but does not own the decision. Good institutional use requires transparent methods, error estimates, versioned data, and a clear distinction between ‘what the measurement says’ and ‘what the authorised body decides to do’.

What this career made visible, and what remains hidden

Across routing, spam, broadband, censorship, smart homes, and machine learning, Feamster’s projects repeatedly turn scattered operational problems into evidence systems. rcc maps configuration to invariants; RCP gives path selection a wider view; reputation systems infer coordination from metadata; the gateway isolates some broadband factors; censorship systems compare distant signals; IoT Inspector connects device traffic to user labels; the NetML projects put representation, deployment cost, and drift in the same framework.

These systems do not make the internet fully knowable. Passing a configuration check does not eliminate physical faults; a reputation score does not prove ‘guilt’; a speed measurement does not explain price; a DNS anomaly does not identify a particular government agency; encrypted metadata does not reveal every action of a device; synthetic traces do not guarantee privacy; and a language model is not automatically correct just because its diagnosis is coherent.

These boundaries are not a reason to reject measurement but a requirement to design the operational systems around it carefully. Useful evidence should show source, age, scope, and uncertainty. High‑impact actions should have review, appeal, or rollback mechanisms. Researchers should state whether a result is a paper report, an institutional report, or independently reproduced. Commercial claims cannot automatically inherit the authority of an academic publication without independent evidence.

Feamster’s long‑term contribution is the repeated construction of this intermediate layer between opaque infrastructure and high‑stakes decisions. His work helps operators, researchers, users, and public bodies ask better questions of systems that were not designed to ‘explain themselves’. The result is not absolute certainty, but a stricter account of what is observation, what is inference, and what remains judgement.