Markdown Version | Transcript | Recording 1 | Recording 2 | Recording 3 | Recording 4 | Session Materials

ANRW

Summary

The second session of the Applied Networking Research Workshop (ANRW) at IETF 126 was chaired by Georg Kot. The session was dedicated to Security and Privacy, featuring five technical presentations on unequal privacy in multi-party proxy infrastructures, zero-shot IoT device labeling, algebraic frameworks for source address validation, the real-world deployment limitations of Discovery of Designated Resolvers (DDR), and the performance of QUIC-based encrypted DNS in Indian access networks.

Key Discussion Points

1. Unequal Cover: Measuring Privacy Disparities in Proxy Infrastructure

• Presentation: Security and Privacy - Unequal cover
• Presenter: Paul Schmidt
• Discussion Summary:
  • Paul Schmidt presented a study evaluating the geographic and socioeconomic disparities in privacy protections offered by Multi-Party Relays (MPRs), with a specific focus on Apple's iCloud Private Relay in the United States.
  • The research modeled how the allocation of egress IP addresses to maintain local geolocation accuracy affects the size of the anonymity set ("crowd size") for users. Using US census tract data, the study found that rural tracts experience 9.3 times smaller median crowd sizes compared to urban areas.
  • In rural tracts, smaller crowd sizes strongly correlate with lower median income and education levels, resulting in a compounding disadvantage for vulnerable populations.
  • A simulation showed that by strategically consolidating or removing roughly 19% of the smallest egress locations, systems can increase the median crowd size by 2.5 times (from 5,800 to 14,000) with only a negligible penalty to geographic accuracy (mean distance to egress rising from 8.6 km to 10.2 km).
• Q&A and Comments:
  • Tommy Pauly noted that iCloud Private Relay includes a user setting to opt for a broader "time zone" granularity instead of "local location," which aligns with the presentation's suggestion of expanding the anonymity set. He asked about the study's adoption rate metric; Paul Schmidt clarified they assumed a uniform 0.11% adoption baseline based on APNIC data. Tommy Pauly suggested that expanding the study to measure international disparities would be highly valuable.

2. Zero-Shot IoT Device Type Labeling

• Presentation: Security and Privacy - Zero-Shot IoT Device Type Labeling
• Presenter: Virit Shibakaschasida
• Discussion Summary:
  • Virit Shibakaschasida introduced "Zelle," a system designed to label previously unseen IoT devices (vendor and device function) completely offline and without prior training samples (zero-shot).
  • Zelle extracts passive telemetry data (such as MAC prefixes, hostnames, and domains) and enriches it by querying search engines to retrieve contextual details from blogs, forums, and manuals.
  • A zero-shot classification model (RoBERTa) then maps the enriched data against a pre-compiled catalog of 1,040 vendors and 41 device functions. Zelle achieved 86% accuracy in vendor labeling and 55% (lab) / 81% (wild) accuracy in function labeling.
• Q&A and Comments:
  • Suresh Krishnan asked whether the system could ingest Manufacturer Usage Description (MUD) profiles (RFC 8520) to improve accuracy. The presenter agreed that using such standardized manufacturer specifications could serve as a valuable input.
  • Stuart Cheshire raised a security design question regarding the inherent tension between device privacy (preventing tracking/fingerprinting) and a local network operator's need for visibility. He also asked how the increasing trend toward end-to-end traffic encryption affects Zelle. Virit Shibakaschasida responded that the system is intended to run on security gateways/firewalls where SSL/TLS decryption or edge inspections are performed. Future work will investigate resolving devices obscured behind NATs and hubs.

3. An Algebraic Framework for Source Address Validation

• Presentation: Security and Privacy - An Algebraic Framework for Source Address Validation
• Presenter: Li Bin Liu
• Discussion Summary:
  • Li Bin Liu presented "SAV-A," the first algebraic framework designed to unify and analyze Source Address Validation (SAV) mechanisms.
  • The framework mathematically formalizes SAV states as a trust-level lattice with distinct aggregation and extension operators. This allows legacy SAV approaches—such as Strict, Loose, and Enhanced Feasible Unicast Reverse Path Forwarding (EFR-URPF)—as well as the newer SAVNET protocol to be modeled as specific instantiations of the same algebra.
  • Using this framework, the authors proved convergence to a unique least fixed point, analyzed correctness under asymmetric routing, and evaluated how the system behaves during topology changes.
  • Evaluations across large-scale AS topologies demonstrated 100% agreement with real-world behavior and showed that a partial SAV deployment of 10% can successfully filter out 96.4% of spoofed traffic.
• Q&A and Comments:
  • Suresh Krishnan commended the formalization of SAV. Li Bin Liu invited interested working group members to participate in the SAVNET session.

4. The Illusion of DDR Deployment

• Presentation: Security and Privacy - The Illusion of DDR Deployment
• Presenter: Yevgenia
• Discussion Summary:
  • Yevgenia presented an updated analysis of Discovery of Designated Resolvers (DDR) deployment among open resolvers.
  • While initial measurements suggested that roughly 300,000 open resolvers supported DDR, over 90% of those resolvers returned DDR records pointing to major public resolvers (e.g., Google or Cloudflare) rather than their own designated endpoints.
  • To investigate this discrepancy, the researcher added a forwarder-detection scan. The results confirmed that this "deployment" is an illusion caused by transparent DNS forwarders. Instead of handling queries for _dns.resolver.arpa locally (as mandated by the DDR specification), these forwarders pass queries upstream to public resolvers and return the unverified upstream DDR response to the client.
  • In reality, only about 900 open resolvers have correctly deployed and configured DDR.
• Q&A and Comments:
  • Marco Davitz asked whether the research included client-side measurements, noting that he had struggled to get modern browsers to upgrade to encrypted DNS via a correctly configured local resolver. Yevgenia clarified her studies only measured resolver-side behaviors.
  • An unnamed Firefox developer thanked the presenter, stating that Firefox is actively implementing DDR and that knowing how many networks correctly match local IP addresses to their certificates is highly valuable.
  • Tommy Pauly asked if the scanning setup could detect whether intermediate networks were dropping or blocking DDR discovery records. Yevgenia replied that the current scanner design could not detect such path-blocking events.
  • Lohit Karyala asked about the frequency and consistency of the measurements. Yevgenia indicated she has run these scans weekly and monthly for three years, and the deployment numbers have remained statically flat. A researcher from the Hasso Plattner Institute also confirmed that their independent studies yielded identical findings.

5. QUIC Meets Reality

• Presentation: Security and Privacy - QUIC Meets Reality
• Presenter: Jayshree (on behalf of co-author Lohit Karyala)
• Discussion Summary:
  • This presentation was delivered by Jayshree after the initial presenter, Lohit Karyala, experienced severe audio connectivity issues.
  • The research evaluated the real-world deployment and performance of encrypted DNS protocols over QUIC, specifically DNS-over-QUIC (DoQ) and DNS-over-HTTP/3 (DoH3), within Indian access networks (focusing on major ISPs Jio and Airtel, alongside academic networks).
  • Using custom scanning tools (QDNSscope and QDNSperf), the study discovered 28 validated encrypted DNS resolvers in India across 13 ASNs and 18 ISPs.
  • Among these, 18 supported DNS-over-HTTPS (DoH), 13 supported DoQ, and only 2 supported DoH3. Additionally, 82.1% of these resolvers possessed valid certificates, while the remainder used self-signed or expired certificates.
  • The geographic distribution of these resolvers was heavily skewed toward Western and Southern India, with almost no deployment in Eastern or Northern regions. Despite limited adoption, the measurements showed clear connection-startup and latency performance benefits for DoQ compared to standard DoH.
• Q&A and Comments:
  • Suresh Krishnan noted that the research currently relies on a single vantage point and asked about expanding the scope. Jayshree confirmed that evaluating performance from multiple heterogeneous vantage points is the primary focus of their future work.

Next Steps

• Unequal Cover: Further studies are planned to assess geolocation anonymity and MPR deployment patterns across countries outside the United States.
• Zero-Shot IoT Device Labeling: The authors of Zelle will investigate methods for labeling IoT devices located behind NAT gateways or hubs.
• DDR Deployment: Browser and OS developers (including the Firefox security team) will leverage these findings to refine client-side validation logic when dealing with transparent forwarders that leak unverified DDR records.
• QUIC in India: The research team plans to scale their performance evaluation by utilizing multiple geographically distributed vantage points across Indian broadband and cellular networks.

Session Date/Time: 20 Jul 2026 07:00

ANRW

Summary

The Applied Networking Research Workshop (ANRW) at IETF 126 was chaired by Maria and Oliver Hohlfeld. This joint workshop of the IRTF and ACM supports long-term research related to network standards and protocols. Out of 61 submissions (48 long papers and 13 short papers), 26 papers were accepted (20 long and 6 short). The workshop agenda featured a keynote presentation, followed by four technical sessions. These minutes cover the workshop introduction, the keynote address, and Session 1 (Network Management), which concluded prior to the morning break.

Key Discussion Points

1. Introduction and Workshop Overview

• Chairs: Maria and Oliver Hohlfeld
• Slides: Chair slides
• Oliver Hohlfeld welcomed the participants and reminded them of the IRTF Note Well, Code of Conduct, and Meetecho requirements.
• The chairs thanked the Technical Program Committee (TPC) for their timely and high-quality reviews. They noted that due to minor last-minute complications with authors, the papers were not yet live on the ACM Digital Library but would be linked to the workshop page as soon as they became available.

2. Keynote: Critical Infrastructures in Transition: Internet, Power Grid, and Their Interaction

• Presenter: Johanna Ullrich (IT:U Austria / SBA Research)

• Slides: Keynote

• Discussion:

  • Johanna Ullrich introduced the newly established Interdisciplinary Transformation University (IT:U) in Linz, Austria, emphasizing its focus on project-based, interdisciplinary education.
  • Three Internet Transitions:
    1. Commercialization: The shift from an academic trust-based network to a profit-driven commercial network. While standard security consideration sections have grown, security is still an ongoing challenge.
    2. IP Convergence and Criticality: The phase-out of traditional dedicated backup networks (e.g., analog telephony, terrestrial broadcasting) in favor of all-IP systems. Consequently, the Internet is now a single point of failure in crises (e.g., during the war in Ukraine, where network outages correlated heavily with power failures).
    3. Geopolitical Borders: The end of the "borderless Internet" myth, highlighted by censorship, firewalls, and EU concerns regarding digital sovereignty and reliance on non-European cloud hyperscalers.
  • Internet vs. Power Grid: Johanna compared the Internet with the power grid, noting that both are large, decentralized, ossified systems undergoing massive transitions (e.g., electrification and renewable energy integration).
  • Rigorous Measurements: The presenter argued that Internet measurements must transition from an engineering-focused mindset (measuring what is easy/available) to a rigorous, deductive scientific model (falsifying hypotheses, error calculations, and systematic replication). This rigor is critical as measurements increasingly inform public policy and state regulations.
  • Security Threats to the Power Grid via the Internet: Johanna presented research on how a coordinated botnet could destabilize the European power grid (50 Hz frequency). Power grid reserves have a 30-second response latency. A botnet controlling the loads of ~1.5 million infected smart devices (like EV chargers or heat pumps) could rapidly drop or spike electricity consumption, causing a blackout before grid operators can stabilize it. Johanna noted that malicious intent is not even required; random software errors or sudden shifts in Bitcoin mining loads could trigger equivalent failures.

• Q&A:

  • Kurtis Heimerl (referencing relevant HotNets papers in the chat) asked about how the community should balance natural sciences with the social aspects of Internet usage. Johanna agreed both perspectives are necessary, adding that we must seek out invariants in the Internet's structure to measure.
  • An unnamed participant asked whether the Internet community has a role to play in combating screen addiction or regulating minimum age access to social networks. Johanna stated that as a technical scientist, she is not an expert in social psychology, but as a citizen, she supports the ongoing societal debate.
  • Oliver Hohlfeld noted that current measurement infrastructures (like RIPE Atlas or CAIDA) are incomplete and poorly funded, which often invalidates broad claims. Johanna agreed and emphasized the need to understand and calculate measurement biases first.
  • Maria closed the session by inviting attendees to participate in the IRTF Measurement and Analysis for Protocols Research Group (MapRG).

3. Session 1: Network Management

Unified Network Abstraction Layer via Knowledge Graph

• Presenter: Jefferson Campos Nobre
• Slides: Network Management - Unified Network Abstraction Layer via Knowledge Graph
• Discussion:
  • The presentation focused on data model heterogeneity and semantic fragmentation across network hardware vendors (e.g., different interpretations of empty YANG leaves for interface admin-status in Cisco, Huawei, and Juniper).
  • The authors proposed a three-layer knowledge graph abstraction model (Semantic layer for vendor-independent concepts, Mapping layer for vendor-specific associations, and Operation layer for real-time state values).
  • The framework was implemented using Neo4j (utilizing the Cypher query language) and a NETCONF parser to successfully retrieve and unify configurations from multiple vendors.
• Q&A:
  • Yunze asked about the cost/difficulty of adding new modules or vendors and whether this mapping process is automated. Jefferson clarified that in this initial proof of concept, the mappings were built manually by a master's student, but they are currently exploring Large Language Models (LLMs) to automate ingestion.
  • Eric Burger also asked about the level of automation in the ingestion process. Jefferson reiterated that automation via LLMs is one of the primary active paths of their research.

BoostState: Reducing State Transfer Latency in Edge Cloud

• Presenter: Tom Guan
• Slides: Network Management - BoostState
• Discussion:
  • Tom Guan presented a framework designed to reduce state transfer latency for stateful Network Functions (NFs) in edge clouds during scaling, migration, or failovers.
  • While CPU-based state transfers introduce high latency, running NFs entirely on programmable hardware (like SmartNICs or Tofino switches) breaks conventional cloud deployment pipelines.
  • BoostState implements a hardware-software co-design: NFs remain on the CPU, while a programmable data plane (P4 on a Netronome SmartNIC) continuously tracks and transfers "header states" (5-tuple information). Only the remaining "action states" are sent via the CPU when migration is triggered.
  • Evaluations of split/merge operations in scaling and fault-tolerant scenarios demonstrated up to a 60% reduction in transmission latency compared to state-of-the-art software-only methods.
• Q&A:
  • Maria asked about the overhead introduced by continuously copying states to ensure fault tolerance. Tom replied that because stateful NFs must copy state periodically for failovers, reducing the transfer latency of each operation is key to keeping the performance impact minimal.
  • Michal asked why edge clouds are more complex than traditional clouds and how the state partition operates. Tom explained that edge applications (e.g., AR/VR, robotics) have extremely strict latency constraints, and the highly distributed topology of the edge makes low-latency state synchronization a critical challenge.

Small Packets, Big Difference (Dynamic Segment Sizing in TCP Prague)

• Presenter: Dinesh
• Slides: Network Management - Small Packets, Big Difference
• Discussion:
  • Dinesh presented on Dynamic Segment Sizing (DSS) for TCP Prague in L4S environments.
  • In high-congestion, low-bandwidth environments (e.g., 100 kbps), sending a standard 1500-byte MSS packet takes a long time, leading to less than one packet sent per RTT. This limits the granularity of the ECN signals back to the sender.
  • TCP Prague keeps a minimum window of two packets to preserve feedback granularity. Under very low bandwidth, this is done by shrinking the packet size dynamically.
  • The authors designed a pacing-rate-based DSS that removes reliance on noisy smooth RTT calculations. They implemented this in the Linux kernel and compared it against linear, exponential, and fixed-packet baselines.
  • The results showed a significant decrease in retransmission rates and improved Jain's Fairness Index when Prague flows competed with Cubic or BBR flows.
• Q&A:
  • Lars Eggert asked if the flows evaluated were purely bulk flows and if they had looked at non-bulk traffic. Dinesh confirmed they used iperf bulk flows to verify that the dynamic segment sizing kicked in, but they also evaluated inelastic traffic using hping. Lars also asked about the header-to-payload overhead of small packets. Dinesh replied that the dramatic decrease in packet retransmissions offset the header overhead.
  • Gorry Fairhurst asked how the mechanism handles tunnel encapsulation overhead (e.g., if a 150-byte packet is further wrapped in tunnel headers at the bottleneck). Dinesh answered that even with additional overhead, having multiple smaller packets is preferable because it preserves the granularity of ECN feedback.
  • An unnamed participant ("Keti") asked how long the fairness experiments ran. Dinesh confirmed they ran for more than 4 to 5 minutes, which was long enough to observe BBR convergence.

Towards Encrypted Zero-Copy L7 Load Balancing

• Presenter: Michal
• Slides: Network Management - Towards encrypted zero-copy L7 load balancing
• Discussion:
  • Michal presented a research prototype aimed at removing memory copies in Layer 7 load balancers.
  • While L4 load balancers simply route packets, L7 load balancers must parse application headers (e.g., HTTP), which is resource-intensive when encrypted.
  • By offloading TLS to hardware and utilizing a user-space TCP stack (XLO) with a specialized zero-copy API, the load balancer can pass data using pointers rather than copying data buffers.
  • Using a proof-of-concept built on nghttpx (based on nghttp2), the authors demonstrated up to a 2x throughput performance improvement for large files.
• No Q&A was recorded for this talk.

PINOCCHIO: Queuing Onset Prediction in Mobile Edge Networks

• Presenter: Anudeep
• Slides: Network Management - PINOCCHIO
• Discussion:
  • Anudeep presented PINOCCHIO, a framework designed to predict the near-future onset of queuing in mobile edge networks using Reservoir Computing / Echo State Networks (ESN).
  • Instead of relying on packet loss or RTT, the framework uses a Queue Buildup Indicator (QBI)—the difference between the estimated packet count sent by the server and the count received by the User Equipment (UE).
  • The framework was evaluated on a 5G testbed using OpenAirInterface (OAI). Results showed that PINOCCHIO could successfully predict queuing onset 50 to 100 milliseconds before it occurred, even when tested against unseen TCP Cubic and BBR flows.
• Q&A:
  • Ludwig (Deutsche Telekom) asked how this approach compares to L4S, which explicitly marks the onset of congestion at the scheduler. Anudeep replied that this is a preliminary work and evaluating/integrating PINOCCHIO with L4S is a major item in their future research pipeline.

Next Steps

• Knowledge Graph Abstraction: Continue research into using LLMs to automate the parsing of vendor-specific YANG models and generating mapping layers.
• PINOCCHIO: Integrate the queue prediction framework with an active rate controller to measure actual network utilization and latency improvements. Compare performance directly against L4S deployments.

Session Date/Time: 20 Jul 2026 12:00

ANRW

Summary

The Applied Networking Research Workshop (ANRW) session at IETF 126 featured a dedicated track on network measurements, comprising seven long papers and one short paper. The presentations spanned novel datasets and measurement frameworks, reproducibility in network emulation, incident triage, multicast routing improvements, IPv4 subnet detection, reliable VPN transport options, RTC relay deployments, and formal algebraic measurement specifications.

Key Discussion Points

1. pcapML

• Presenter: Paul Schmidt (Cal Poly / Princeton University)
• Technical Details: Machine learning models for network traffic depend heavily on labeled traces. However, dataset pipelines are often underspecified, with labels stored separately from PCAPs (e.g., encoded in filenames or external text files). This leads to inconsistent data reconstruction (for example, the popular "VPN, non-VPN" dataset has been parsed into anywhere from 2 to 31 distinct classes by subsequent researchers). To address this, the authors introduced pcapML, which encodes arbitrary metadata directly into the pcapng comment fields, keeping labels self-contained within the packet capture. The tool supports live capture via eBPF (associating sockets to process names in the kernel) and offline conversion.
• Discussion:
  • Danish asked about the runtime overhead of performing live labeling. Paul replied that while it does inflate the PCAP file size, they did not find a performance limit during tests on a desktop and an OpenWrt router.
  • The Session Chair suggested that the tool could be extended to include structured information about the packet type (such as TLS or QUIC) directly inside the comment fields to optimize subsequent filtering and analysis. Paul agreed this would be a valuable addition.

2. NixNet

• Presenter: Benedict (Technical University of Munich)
• Technical Details: Replicating emulated network experiments is difficult due to unmanaged dependencies, compiler discrepancies, host environment pollution, and deprecated packages. NixNet is a lightweight, virtual network emulation platform that uses the Nix package manager to pin and construct the complete dependency graph (build-time and runtime closures) of an experiment. NixNet isolates experiment execution using Linux namespaces (similar to Docker but without requiring root privileges) and uses a declarative schema to automatically generate reproducible configurations.
• Discussion:
  • Shavit (Tel Aviv University) questioned the ultimate value of strict environmental reproducibility, noting that if network experiments are highly sensitive to minor system parameters, the underlying scientific results themselves might not be robust. Benedict replied that while network emulation is inherently non-deterministic, having an identical, shareable baseline environment is crucial for researchers seeking to verify or build directly on top of prior work.
  • An audience member asked how network impairments (such as packet loss and latency) are integrated. Benedict explained that NixNet leverages standard Linux traffic control (tc-netem) but supports custom bash hooks to integrate external emulators.
  • An audience member asked whether NixNet relies on the upstream NixOS testing framework's topology builder. Benedict clarified that NixOS's testing framework is too restrictive for complex topologies, so NixNet uses its own custom JSON-like schema to generate virtual ethernet interfaces and namespaces.

3. Explainable Routing-Aware Incident Triage

• Presenter: Petia Vasilova (CERN / Worldwide LHC Computing Grid)
• Technical Details: The Worldwide LHC Computing Grid (WLCG) transfers up to 10 petabytes of scientific data daily. To monitor performance, WLCG deploys perfSONAR active measurement nodes. Aligning these measurements is challenging due to varying cadences (latency is measured every minute, traceroutes every 10 minutes, and throughput every 6 to 24 hours). The authors developed a framework that models paths as graphs using 32-dimensional node embeddings (using AS numbers or IPv6 /64 prefixes) combined with structural path features (such as path length, TTL gaps, and IP repetition). This model calculates a composite anomaly score to triage routing-induced performance incidents without requiring external BGP feeds.
• Discussion:
  • Anant (Netflix) asked if a 10-minute traceroute frequency is sufficient to capture transient routing events and whether they perform link-level analysis. Petia noted that due to storage limits, they cannot increase the traceroute frequency and must focus on longer-lasting routing incidents rather than transient ones. Paths are analyzed at the AS and prefix level.
  • Sam (University of Trento) asked why they deployed a custom probing mesh instead of using public platforms like Ripe Atlas. Petia clarified that the decision to use a dedicated perfSONAR infrastructure was established by the WLCG community before she joined the project.

4. Intradomain Multicast Routing for Modern Routers

• Presenter: Anthony (UCLouvain)
• Technical Details: Traditional multicast routing protocols like Protocol Independent Multicast (PIM) do not account for physical router hardware limits. Modern routers have multicast Forwarding Information Base (mFIB) capacities ranging from 1,000 to hundreds of thousands of entries. If a router's mFIB is exhausted, incoming PIM joins are silently ignored, causing traffic loss without notifying the receiver. The authors proposed exposing mFIB capacity and usage in the control plane using Link State Protocols (OSPF or IS-IS) with a threshold-based flooding approach. They introduced two path-computation algorithms, Pruned Shortest Path (Pruned SP) and Shortest Widest Path, to dynamically route multicast joins around congested routers.
• Discussion:
  • Max asked if they considered combining link bandwidth capacities with mFIB constraints during path computation. Anthony confirmed this is possible and is a planned extension of the work.
  • Thomas Schmidt asked why this state propagation wasn't engineered directly into PIM and suggested that flooding the entire network with mFIB state might be excessive compared to local threshold signaling. Anthony replied that leveraging link-state routing protocols aligns with modern standards design (like Segment Routing) and that their coarse-grained thresholds at low utilization help minimize control plane overhead.

5. Detecting IPv4 Subnets in the Wild

• Presenter: Faribhar (Max Planck Institute for Informatics)
• Technical Details: Discovering how network operators partition BGP prefixes into internal subnets helps improve IP resource utilization studies, geolocation, and abuse handling (referencing RFC 1997). The authors developed two active probing methodologies: ICMP Echo (pinging network and broadcast boundaries) and ICMP Address Mask (utilizing deprecated RFC 950 queries). Lab experiments showed that Cisco routers uniquely populate the ICMP Echo reply source address with the receiving interface IP when pinged on a subnet broadcast address. Probing the entire routable IPv4 space yielded 2 million subnets via ICMP Echo and 1.8 million via Address Mask.
• Discussion:
  • The Session Chair pointed out that directed broadcast has been disabled by default on Cisco routers for a long time and asked about the firmware versions tested. Faribhar clarified that they tested Cisco 2900 series routers in their lab and that despite default configurations, a substantial number of active devices on the Internet still respond to these probes.
  • Sam (University of Georgia) asked how the methodology detects /31 subnets (which lack traditional broadcast addresses) and whether the team validated their findings with network operators. Faribhar explained that they filter out cases where the network and broadcast pings yield identical source IPs to eliminate false positives.

6. Reliable Virtual Private Networks

• Presenter: Kilian (Technical University of Munich)
• Technical Details: Demanding site-to-site WAN use cases require VPNs to provide reliable transport, low loss, and minimal delay. The authors compared WireGuard, OpenVPN, and MASQUE (which utilizes HTTP/3 and QUIC). They benchmarked MASQUE under simulated random and burst loss conditions using four reliability mechanisms: retransmissions, Forward Error Correction (FEC), multipath QUIC, and connection nesting (overlays). While retransmissions successfully prevent end-to-end packet loss, they introduce significant tail latencies (~100ms) under burst loss. Implementing FEC successfully eliminated end-to-end losses while keeping the one-way delay low (~44ms) by avoiding retransmission round-trip times.
• Discussion:
  • An audience member from the Chinese University of Hong Kong asked about the specific real-world use cases for reliable VPNs. Kilian answered that they are primarily needed for legacy industrial applications that were not designed to operate over lossy wide-area networks, as well as high-reliability site-to-site connectivity.

7. RTC Relay

• Presenter: Pei Jin (University of Maryland)
• Technical Details: Real-Time Communication (RTC) applications rely on relay servers (TURN/STUN) when direct peer-to-peer connections cannot be established. The authors conducted a global measurement study of the relay infrastructures used by Discord, WhatsApp, and Zoom. Employing distributed Azure VMs and Xcode-automated iOS clients to make repeated automated calls, they mapped relay locations and analyzed fallback behaviors. Zoom Free was found to rely on only two self-hosted, US-based relays, while Zoom Business features 11 nodes. Discord uses a hybrid model (80% Cloudflare, 16% Google Cloud, 5% i3d.net). WhatsApp has the largest footprint (25 global locations, all self-hosted by Meta) and uses a joint-aware STUN binding allocation that measures end-to-end latency to pick the optimal relay.
• Discussion:
  • Danish (MPI) asked whether using Azure VMs as the call vantage points might skew the discovered relay locations. Pei Jin acknowledged that they likely missed some regional relays but emphasized that the study's primary goal was to compare the structural deployment and selection strategies across the different platforms.

8. Towards Extensible, Auditable, and Modular Measurement

• Presenter: Innocent (University of Washington)
• Technical Details: The short paper proposes a formal, relational algebra framework called the Measurement Template Language (MTL). Active measurements are often tightly coupled to specific CLI utilities (e.g., calling ping or scamper directly in scripts). MTL decouples the abstract logical probe, the measurement driver/tool, and the physical resource execution layer. By defining mathematical relations and guard interfaces, components can be swapped dynamically (such as exchanging scamper for native Linux ping) without breaking higher-level experimental logic or policies.
• Discussion:
  • The Session Chair asked if there is a concrete, usable software implementation. Innocent responded that they have verified the design in their lab by driving scamper and are currently developing an open-source Go library to implement the algebraic measurement semantics.

Next Steps

• pcapML: The developers plan to implement a standard libpcap wrapper to allow the tool to run natively on macOS and Windows without requiring eBPF.
• NixNet: The authors plan to support macOS targets by running Linux virtual machines, as the current namespace-based isolation is Linux-specific.
• Intradomain Multicast: Future research will explore incorporating real-time link bandwidth and latency metrics directly into the multicast tree path selection algorithm.
• RTC Relay: Future work includes running measurements over a longer, continuous time horizon, increasing the geographical coverage of the testing VMs, and expanding the analysis to other real-time communication applications.
• MTL (Measurement Template Language): The authors are working on releasing a public, open-source Go library implementing the modular measurement framework.

Session Date/Time: 20 Jul 2026 14:30

ANRW

Summary

The Applied Networking Research Workshop (ANRW) session at IETF 126 focused on the latest academic and practical research in transport protocols, media streaming, and quality of experience (QoE) management. The presentations covered a wide range of topics, including the evaluation of QUIC in space networks, multiplexing techniques for WebRTC and Media over QUIC (MoQ), new scheduling architectures for Multipath QUIC (MP-QUIC), and a C-based open-source implementation of IETF Transport Services (TAPS).

Key Discussion Points

1. QUIC in Space: Initial Measurements and Analysis

Presenter: Natalia Petroski

• Discussion: Natalia presented research evaluating the performance of QUIC and its extensions over simulated satellite links, targeting lunar and deep space communication characteristics. The study focused on two protocol extensions:
  • ACK Frequency: Intended to optimize asymmetric links by delaying ACKs (via adjusting max_ack_delay and ack_threshold). In evaluations using the Quinn implementation, it showed no significant improvements in flow completion times.
  • Careful Resume: Caches congestion control parameters (CWND and minRTT) to shorten the slow start phase in recurring connections. This showed promise in Quiche but had minor performance degradation in Quinn's BBR implementation due to implementation issues.
  • The study also evaluated single and dual outages, demonstrating that Cubic (specifically in Quinn) struggled to recover compared to BBR, which recovered faster due to its bursty transmission characteristics.
• Q&A:
  • Gorry Fairhurst noted that testing like this is valuable for stress-testing protocols. He highlighted that previous work on Careful Resume in Cloudflare's Quiche also revealed unexpected timing errors during recovery. He asked if "Happy Eyeballs" (RFC 8305) was considered for racing QUIC and TCP; Natalia replied it was not.
  • Robert asked how the 25 Mbps bottleneck data rate was selected. Natalia explained that this corresponds to the inter-satellite link capacity of Iridium satellites.
  • Danish asked whether the simulated outages were designed to align with BBR's probing phases (bandwidth or RTT probing). Natalia confirmed they did not take BBR's specific phase into account.

2. u and i: H3 Prioritization for Cooperative Scheduling in MASQUE

Presenter: Daniel

• Discussion: Daniel presented a study on how the Extensible Prioritization Scheme for HTTP (EPS, RFC 9218) can enable cooperative scheduling in MASQUE proxies. Using the u (urgency) and i (incremental) parameters, the client can signal transport intent directly to the proxy.
  • The authors designed "MASQUE-NADA", a prototype built on tokio-quiche featuring a pluggable scheduling interface at the proxy.
  • Key Findings: While priority semantics are lost under unreliable MASQUE (as EPS only applies to streams), reliable MASQUE streams successfully used urgency to prioritize flow completion times. The incremental flag prevented head-of-line blocking among parallel streams. An "EPS-aware" scheduler was shown to dynamically balance path performance under heterogeneous path conditions.
• Q&A:
  • Lucas Pardue commented that proxy scheduling (especially with multipath) is highly complex. He shared a link to his draft, draft-pardue-masque-dgram-priority, which focuses on Datagram priorities, and suggested exploring potential overlaps.

3. QUIC as Multiplexing Layer in WebRTC

Presenter: Matthijs Engelbart

• Discussion: Matthijs presented an architecture for multiplexing data channels and media in WebRTC using QUIC to replace the traditional UDP/DTLS/SCTP stack.
  • By running RTP over QUIC (draft-ietf-avtcore-rtp-over-quic) alongside data channels on a single QUIC connection, they share a single congestion controller (such as Google Congestion Control - GCC). This prevents SCTP data channels from starving real-time RTP media.
  • A prototype was implemented in Go, incorporating the packet receive timestamp extension for delay-based bandwidth estimation. The system prioritizes media over data channels while allowing elastic data channels to utilize remaining bandwidth.
• Q&A:
  • Gorry Fairhurst asked if partial reliability was considered for media streams. Matthijs clarified that they utilized standard QUIC streams but canceled them after a specific timeout if the frames became too late to render.
  • Francois Michel asked about the applicability of this approach to WebTransport. Matthijs indicated that while RTP over QUIC is currently optimized for raw QUIC, adapting it for WebTransport is a logical next step to make it easily deployable in web browsers.
  • Dirk Kutscher asked for clarification on whether QUIC streams were used for encapsulation, which Matthijs confirmed.

4. Reset the Stream, Keep the Keyframe: Low-Latency Live Streaming over MoQ

Presenter: Sebastian (Gdańsk University of Technology)

• Discussion: Sebastian discussed strategies for managing network congestion in Media over QUIC (MoQ) live streaming.
  • Under high congestion or packet loss, simply resetting a stream when a timer expires can result in the loss of crucial Group of Pictures (GOP) keyframes, wasting transmission bandwidth.
  • The proposed solution leverages the ResetStreamAt extension (draft-ietf-quic-reliable-stream-reset) to set a reliable boundary directly after the keyframe. This ensures that keyframes are guaranteed delivery, while subsequent, dependent P-frames can be safely discarded during congestion.
  • Evaluations showed that protecting keyframes bounding stalls to approximately one GOP duration (one second) with negligible latency cost.
• Q&A:
  • Gorry Fairhurst asked if different types of video with varying keyframe-to-P-frame ratios were evaluated. Sebastian replied that while keyframe size remains relatively constant, P-frame sizes are highly scene-dependent, which would require adjusting testbed bandwidth profiles.
  • Lucas Pardue noted that the ResetStreamAt draft had just progressed to IETF Last Call. He asked how the scheduler handled the retransmission of lost data. Sebastian noted that during the IETF 126 Hackathon, they experimented with prioritizing fresh data over retransmissions, though discarding data entirely still performed better.

5. Multiplexing Synchronized Media

Presenter: Ali Begen

• Discussion: Ali introduced "Mocktail" (available at MoQtail.dev), an open-source MoQ implementation designed for "Watch Party" (social co-viewing) use cases.
  • Traditionally, watch parties require a complex, dual-stack setup: LL-HLS for the main stream and WebRTC for video conferencing. This "Frankenstein" approach results in competing congestion controllers and high integration complexity.
  • The proposed MoQ solution uses a single QUIC connection with dual transport pipes:
    1. Context Pipe (High Priority): Carries the main synchronized live stream reliably over QUIC streams.
    2. Excitement Pipe (Medium/Low Priority): Carries real-time conferencing audio and video. Audio is sent via unreliable QUIC datagrams, while video is marked as lowest priority and subjected to early discard during congestion.
• Q&A:
  • Suresh Krishnan asked if there were numerical or experimental results demonstrating that this approach performs better than the multi-stack LL-HLS/WebRTC solution. Ali confirmed that experimental results are detailed in the accompanying paper.

6. Tokens, Not Packets: A New MP-QUIC Scheduling Model

Presenter: Tokens, Not Packets Presenter

• Discussion: The presenter argued that traditional Multipath TCP/QUIC schedulers act as "per-packet" decision functions, which prevents schedulers from deciding what content goes inside the packet (e.g., redundant transmissions, control frame prioritization, and stream multiplexing).
  • The proposed model decouples the scheduling logic from packet assembly by executing the scheduler upfront.
  • The scheduler generates a snapshot of the connection state (ConState) and populates persistent per-path queues containing stream tokens and datagram tokens. A separate packet assembly loop then drains these tokens based on the available congestion window.
  • This model allows for highly customizable scheduling behaviors (such as redundant retransmissions, minRTT scheduling, and control frame prioritizing) by making simple parameter changes to the tokens.
• Q&A:
  • Gorry Fairhurst thanked the presenter, noting that scheduling models are a key area of discussion in transport working groups.

7. Quantifying QoE-Aware Resource Sharing

Presenter: Sebastian (Ericsson Research)

• Discussion: Sebastian presented an analysis of Quality of Experience (QoE) resource sharing for real-time interactive video (e.g., cloud gaming, XR).
  • Because spatial complexity is highly time-variant, equal bitrate allocations result in highly unequal spatial quality (measured in VMAF) among concurrent sessions.
  • Using an oracle-based second-by-second dynamic allocation model, they evaluated a Max Utility policy (prioritizing bringing all sessions above an acceptable VMAF threshold of 50 before optimizing for higher quality).
  • Key Finding: Dynamic second-by-second reallocation can keep 30 active sessions at acceptable quality using only 35 Mbps of bottleneck capacity, whereas static, peak-rate-based allocation models fail to achieve this even at 100 Mbps.
• Q&A:
  • Gorry Fairhurst commended the work and the inclusion of extensive real-world measurement data.

8. An Open Source Implementation of IETF Transport Services

Presenter: Ingrid Tovin

• Discussion: Ingrid presented cTAPS, a C-based open-source implementation of the IETF Transport Services (TAPS) architecture (developed for her Master's thesis at the University of Oslo).
  • cTAPS provides a generic, callback-based API that abstracts transport selection (QUIC, TCP, UDP), security, and lower-level network features (such as local path recovery and DSCP configuration) away from the application. It represents the first open-source TAPS implementation to support QUIC.
• Q&A:
  • Michaud asked if TAPS operates in kernel space or user space and how it bridges the gap with existing socket standards. Ingrid explained that cTAPS is a user-space abstraction library that utilizes standard sockets under the hood, meaning it requires no remote peer cooperation to be beneficial.
  • Thomas Witt asked how a standardized API like TAPS can counter the trend of operating system and cloud vendors introducing proprietary, high-level APIs that undermine open standards. Ingrid responded that because TAPS is defined through open IETF RFCs, cTAPS serves as a democratic, open-source alternative to proprietary ecosystems.

Next Steps

• Chairs' Announcement (Suresh Krishnan): The ANRW program page will be updated by the end of the week. This update will include links to all slide decks on the Datacker, the official ACM proceedings link for the published papers, and the session video recordings.

Related Documents

draft-ietf-avtcore-rtp-over-quic, draft-ietf-quic-reliable-stream-reset, draft-pardue-masque-dgram-priority