Network Measurement in the Dark#

Geoff Huston, APNIC

• Why: The premise underneath every observability investment — that the network can see what traverses it — is being dismantled by protocol design. This is the big-picture frame for why measurement and monitoring assumptions need rethinking, delivered by the person who has been documenting that shift for a decade.
• What: A synthesis of ~15 years of change: operators were once the trusted observers of who-talks-to-whom; that trust eroded through ad-tech profiling and state surveillance (the Snowden papers as watershed), and the IETF responded with RFC 7258 declaring pervasive monitoring an attack. The consequences, with adoption data: HTTPS became near-universal; DNS queries moved behind DoH/DoT/DoQ; and the next step — MASQUE with two-layer encryption and relays — hides the endpoints entirely, so no single network observation point ever sees both ends of a transaction plus the content. The implicit question: what is left for network measurement, and what should operators do about it?
• How: Narrative argument anchored in public adoption statistics (Cloudflare radar for HTTPS, APNIC's encrypted-DNS measurements).
• Where applicable: Universal — it's a framing talk, not a solution talk. Directly relevant to anyone planning traffic measurement, network forensics, capacity planning, or policy enforcement that presumes visibility into flows.