In-band network telemetry (INT) is a promising technique to investigate the real-time state of networks. However, it inevitably generates considerable transmission overhead due to the operational feature of directly inserting telemetry data into the packet header. One of the widely used methods to alleviate such overhead is sampling, which requires a careful selection of sampling rates to control the trade-off between the monitoring accuracy and the transmission overhead. Meanwhile, INT needs to collect various kinds of telemetry items with varying frequency characteristics, leading to different sampling rates to satisfy the desired monitoring accuracy. To address these issues, we propose a frequency-aware item-wise INT scheme, FAT-INT, which uses a novel approach to consider the frequency characteristics of each telemetry item. To this end, we first design a frequency analysis method that examines the frequency characteristics and decides a proper sampling rate for each item. To reflect different sampling rates of each telemetry item, we devise an item-wise probabilistic sampling mechanism to collect items individually considering different sampling rates. Experimental results demonstrate that FAT-INT can reduce transmission overhead by up to 57.6\% of the state of the art, while achieving comparable and robust monitoring accuracy under dynamic network environments.

The advent of IPv6 has posed significant challenges to the detection and analysis of Internet scanning activity. This paper addresses these challenges through novel techniques, unique vantage points, and comprehensive datasets. Our longitudinal analysis reveals a significant and sustained increase in IPv6 scanning activity over the past two years.We introduce new tools and vantage points that leverage proactive techniques to attract IPv6 scan traffic. By deploying the largest-ever IPv6 proactive telescope in a production ISP network, we collected over 600M packets of unsolicited traffic from 1.9k ASes in 10 months. This dataset allowed us to characterize the sources of unsolicited traffic, evaluate the effectiveness of five major features across the network stack, and study the strategies employed by scanners.

Recently, eBPF has emerged as the latest answer to how we should accelerate networked applications. In this paper we ask can all networked applications benefit from eBPF? We answer this question by running several benchmarks under different workloads and by designing different test cases. Our results show that in reality many networked applications cannot benefit from eBPF, and worse the use of eBPF can limit how applications are deployed (because eBPF can lead to performance isolation violations) and the workloads they can handle. We then discuss whether ongoing work can fix the limitations we identify, and propose directions that the community might want to focus on.

Network path conditions, such as loss, capacity, and delay, have a significant impact on the behavior and performance of networked applications. Path property emulators are essential and widely used tools to perform evaluations under realistic conditions. However, the quality of the emulation and the potential influence on experimental results itself is rarely considered. This work highlights how the performance limitations of existing tools, such as NetEm, a network emulator based on Linux traffic control, can alter network measurements. To address these shortcomings, we introduce MoonEm, a high-performance path property emulator based on the Data Plane Development Kit (DPDK). Moreover, we present a novel approach to precisely control packet transmission times on commodity hardware. MoonEm is focused on the emulation of realistic and reproducible network conditions. Our measurements demonstrate that MoonEm achieves a maximum packet rate of 13.39 Mpps compared to 0.98 Mpps for NetEm. In contrast to NetEm, we improve latency deviation from 71.15 µs to 53 ns for the median and from 769.26 µs to 80 ns for the worst case.

When physical testbeds are out of reach for evaluating a networked system, we frequently turn to simulation. In today's datacenter networks, bottlenecks are rarely at the network protocol level, but instead in end-host software or hardware components, thus current protocol-level simulations are inadequate means of evaluation. Detailed end-to-end simulations covering these components on the other hand, simply cannot achieve the required scale with feasible simulation performance and computational resources.

It is fundamentally difficult to simultaneously achieve high simulation fidelity, low simulation time, and minimal resource consumption—especially for large-scale systems. With limited time and resource budgets, users must often compromise on at least one of these dimensions. Unfortunately, existing simulation frame-works do not offer flexible trade-offs among these aspects and are unable to make effective use of the time and resources users can afford.

In this paper, we address this with SepaNet, a simulation framework for practical end-to-end evaluation for large-scale network and distributed systems. SepaNet provides the user abstractions to specify the system to be evaluated, and easily instantiate different simulations for the same system to navigate these tradeoffs: With this abstraction, SepaNet allows users to flexibly trade off simulation fidelity, time, and resource usage by mixing simulation models with different fidelity and controlled parallelization. Finally, SepaNet includes a profiler that identifies performance bottlenecks and helps users make informed decisions about partitioning and resource allocation.

With these capabilities, we demonstrate that SepaNet can simulate a 1200-node datacenter network using 24 cores running end-to-end applications in 175 min for 20 s of system time.

5G and future 6G networks deploy cells with diverse combinations of access technologies, architectures, and radio frequency bands/channels. Cellular operators also employ carrier aggregation for higher data access speeds.

We investigate the fundamental question of how to intelligently and dynamically configure and reconfigure a user equipment's serving cells to deliver the best network performance.

Through comprehensive measurements across 12 cities in 5 countries, we experimentally show the wide availability, heterogeneity, and untapped performance gains of today's cell deployments.

We then put forth a principled performance-driven connectivity management framework, dubbed $\sf\small{OPCM}$. It is a centralized solution deployed at the base station, allowing it to coordinate multiple UEs, enforce operator policies, and facilitate user fairness.

Extensive evaluations show that $\sf\small{OPCM}$ improves the application QoE by up to 65.2%.

Design for low latency networking is essential for tomorrow's interactive applications, but it is essential to deploy incrementally and universally at the network's last mile. While wired broadband ISPs are rolling out the leading queue occupancy signaling mechanisms, the cellular Radio Access Network (RAN), another important last mile to many users, lags behind these efforts. This paper proposes a new RAN design, \textbf{L4Span}, that abstracts the complexities of RAN queueing in a simple interface, thus tying the queue state of the RAN to end-to-end low-latency signaling all the way back to the content server. At millisecond-level timescales, L4Span predicts the RAN’s queuing occupancy and performs ECN marking for both low-latency and classic flows. L4Span is lightweight, requiring minimal RAN modifications, and remains 3GPP and O-RAN compliant for maximum ease of deployment. We implement a prototype on the srsRAN open-source software in C++. Our evaluation compares the performance of low-latency as well as classic flows with or without the deployment of L4Span in various wireless channel conditions. Results show that L4Span reduces the one-way delay of both low-latency and classic flows by up to 98\%, while simultaneously maintaining near line-rate throughput.

Configuration tuning is one of the top network operational tasks and is typically done to either restore performance during degraded network conditions such as congestion, failure, planned upgrades, or optimize service performance through change trials. A long-standing challenge in tuning has been to associate a causal relationship between a configuration change and service performance impact. Confounders (or, external factors) make this extremely hard and non-trivial. In this paper, we focus on improving configuration tuning in the presence of confounders for 5G NSA (Non Stand Alone) networks. We propose a new solution Iridescence that uses attention-based transformers to first de-confound the performance impacts and then improve the impact classification process. We thoroughly evaluate Iridescence using a very large data set collected from an operational 5G NSA network. We share our findings with network engineering and operations teams and confirm the configuration changes that have high likelihood of improving the 5G NSA performance.

As 5G technology has reached its midlife, mobile operators are increasingly rolling out 5G Standalone (SA), which is pivotal in unlocking the full potential of 5G networks. Prior research has mainly focused on 5G Non-Standalone (NSA) performance, while comprehensive evaluations of operational 5G SA deployments remain scarce. Through two cross-country US driving trips (3200+ km) in 2023 and 2024, we conduct, to the best of our knowledge, the first large-scale study of 5G Standalone (SA) deployment in the US, analyzing its evolution while comparing it head-to-head with 5G NSA. Our study shows a shift in 5G deployment priorities from 2023 to 2024 in favor of 5G SA compared to 5G NSA, with 5G SA deployments extending across diverse geographical areas. Advanced features, such as higher carrier aggregation with diverse band combinations and new frequency bands with different duplexing capabilities, allow SA to achieve better performance compared to NSA, whose peak performance has plateaued, reflecting limited upgrades as operators transition to SA infrastructure. Additionally, we examine the handover duration and uplink power control in SA and NSA networks, offering deeper insights into the operational dynamics of the two modes.

Beam management plays a fundamental role in 5G mmWave networks, due to the highly directional nature of mmWave signals. Despite its importance, beam management procedures and real-world performance in operational deployments remain underexplored. This paper addresses this gap by presenting the first in-depth empirical study of beam management procedures in commercial 5G mmWave networks. Our study is based on an extensive measurement campaign across two major US operators, covering six cities, different base station types, and varying mobility scenarios, including walking and driving. We evaluate key beam management parameters on both the base station and the user equipment side, assessing their impact on network performance. In addition, we examine the interaction between beam management and two other mechanisms critical to performance, rate adaptation and carrier aggregation. Finally, we quantify the beamforming overhead and analyze the effectiveness of beam tracking. Our findings provide novel insights into the real-world performance of beam management in 5G mmWave networks, offering guidance for further optimization.

Ang Chen is an Associate Professor in Computer Science and Engineering at the University of Michigan, Ann Arbor.

What does a network connect: people? machines? infrastructures? All three are true, but one tends to dominate at any given time in response to societal needs. Telephony networks interconnected people, but the Internet recast communication as connecting machines. This was a subtle yet profound shift—machines have different failures, misbehaviors, and performance goals, which translated into the network design and still define much of our problem space today. As of late, however, another quiet change is playing out which demands a rethinking of networks. Societal infrastructures, such as power grids, water systems, and datacenters, are increasingly interdependent, but historically they were never designed for coordinated operation. Networking at the "infrastructure nexus" is becoming a pressing need, bringing with it a fresh source of research problems.

Overlay/underlay architecture is increasingly prevalent in modern networks but also introduces greater complexity and error-proneness. Existing control plane verifiers for underlay networks face scalability and interpretability challenges when extended to overlay/underlay networks due to methodological limitations. This paper presents MEV, the first control plane verifier designed for overlay/underlay networks. MEV introduces ensemble verification, a novel verification paradigm enabling independent reasoning for behaviors within each routing instance or protocol and forwarding behaviors within each virtual network. We implement and deploy MEV on a real nationwide overlay/underlay network, FITI, where it successfully identifies 22 misconfigurations that could cause isolation and reachability issues. Furthermore, we evaluate MEV against $\textnormal{Batfish}^+$ on FITI and a range of synthetic networks with diverse scales, and find that it achieves up to a $10^2\times$ speedup over $\textnormal{Batfish}^+$.

Clouds provide latency-sensitive services to clients at geographically distributed sites. Clouds need precise control of client-site mapping for performance and, after a site fails, high availability along with minimum routing reconfiguration and controllable failover load on healthy sites to limit the risk of cascading failures. However, the largest clouds in the world route clients to sites by anycast or unicast with DNS-based redirection---methods that compromise either availability or control. In fact, even beyond these existing techniques, we find that general-purpose approaches for directing clients to sites face inevitable tradeoffs among control, availability and routing stability. We then present new routing techniques and demonstrate via Internet-scale experiments that they provide much better tradeoffs among these three goals than existing techniques. One of our techniques speeds up unicast's failover by up to 5 minutes while preserving its advantages, and another achieves anycast's advantages with much better control. Our techniques establish a new Pareto frontier for cloud routing.

Analyzing transient violations of reachability—that happen while routing protocols are re-converging—helps in improving network availability and offering more precise SLAs. The key challenge is analyzing transient violations accurately, as they can be short-lived, for all affected prefix destinations, and practically, without worsening the network’s performance. Existing approaches fail to address at least one of these goals: measurement approaches are accurate but only for the prefixes they can probe or observe traffic for, while techniques that estimate the convergence time use the same crude proxy for all prefixes.

To achieve all three goals, we present TRIX, a system that infers transient violation times for BGP events from logged routing events or collected BGP messages. TRIX ’s key insight is that we do not need to probe all destinations if we use available information to infer the router-local forwarding state, for all destinations, and reconstruct the network-wide violations from router-level state. However, the logged events contain control-plane information that is inaccurate in terms of the content and the times of the forwarding updates, while reconstructing network-wide violations requires reasoning about the flow of traffic through the network. TRIX solves these challenges by simulating the BGP control-plane, modeling the FIB-update rate, and combining the state across routers with propagation delays. To evaluate TRIX, we implement a testbed that relies on a programmable switch and uses 12 real routers. Our evaluation shows that TRIX’s inferred reachability violation times are on average within 13–25 ms from the ground truth, and inference scales to large networks.

Confidentiality and integrity in remote memory are essential for secure memory disaggregation, they are often overlooked due to performance overhead introduced by security mechanisms. In this work, we design a secure memory disaggregation system that ensures confidentiality and integrity by protecting data in transit and at memory nodes using encryption and signing. To minimize the performance cost of security, our system offloads cryptographic tasks to the RDMA NIC (RNIC). However, due to hardware limitations and relatively slow encryption speed in RNICs, designing an efficient secure memory disaggregation system is challenging. To address these challenges, we propose three key designs in RDMA's encryption data path: dynamic MKey reconfiguration, configuration-data batching, and MKey pooling. We find that overlapping CPU computation and RNIC encryption s crucial to achieving performance benefits from offloading. To enable this overlap, our system adopts a yielding mechanism for encryption, which allows the CPU to perform other work while the RNIC handles encryption. Our evaluation shows that the system achieves up to 9.63$\times$ lower P99.9 latency than a CPU-based implementation on a RocksDB workload, demonstrating that performance and security can be simultaneously achieved in memory disaggregation.

Scanners are daily visitors of public IPv4 hosts. Scanning IPv6 nodes successfully is still a challenge, which an increasing crowd of actors tries to master. In this paper, we analyze current IPv6 scanning under various network conditions. We observe scanner behavior during eleven months in four network telescopes, one of which is periodically reconfigured by changing BGP announcements. We analyze and classify the observed scanners w.r.t. their temporal behavior, their target, and network selection strategy, as well as their individual tools, fingerprints, and correlations across categories. We find that silent subnets of larger prefixes remain invisible, whereas BGP prefix announcements quickly attract attention by scanners. Based on our findings, we derive operational guidance on how to deploy network telescopes to increase visibility of IPv6 scanners.

TAN Kun is currently Chief Scientist of Central Software Institute, Huawei. His team develops cutting-edge AI frameworks, agentic AI systems, cloud native and serverless, and communication technologies for datacenter and AI networks for many Huawei products. Before joining Huawei, he was Research Manager and Senior Researcher in Microsoft Research Asia. He won USENIX NSDI Best Paper Award in 2009, USENIX Test-of-Time Award in 2019, and China State Technological Invention Award for his contribution in cloud computing in 2023.

This talk examines the computing transformation during the era of modern AI revolution. Driven by high computing and bandwidth demand, scale-out datacenter architecture has shifted to scale-up super AI computers. And the evolution of AI models, from dense transformers, to sparse mixture-of-experts, to future agentic AI systems, continuously bring new types of workloads and cast new requirements to computing. Taken together, these render the next-generation accelerated and parallel techniques as well as distributed software designs.

This paper introduces MorphOS, a novel, extensible networked operating system that addresses the runtime inflexibility of unikernels for dynamic, stateful network-intensive applications like Virtual Network Functions (VNFs). While unikernels offer superior performance and minimal resource overheads, their traditional update mechanisms require costly rebuilds and restarts, leading to service disruption and state loss. MorphOS addresses this by integrating eBPF to enable dynamic, verified code execution for seamless updates to packet processing logic. It employs an out-of-band verification service to offload computationally intensive verification tasks and utilizes hardware-assisted memory isolation (Memory Protection Keys) for enhanced execution hardening. Our evaluation of MorphOS with four VNF implementations demonstrates significant benefits: MorphOS drastically reduces reconfiguration time, effectively amortizes verification costs, and achieves up to 3$\times$ better performance compared to Linux-based VNF deployments, all while preserving the inherent lightweightness of unikernels. MorphOS thus paves the way for adaptable, efficient, and state-preserving networked applications in cloud environments.

Kubernetes has emerged as the de facto standard for container orchestration. Unfortunately, its increasing popularity has also made it an attractive target for malicious actors. Despite extensive research on securing Kubernetes, little attention has been paid to the impact of network configuration on the security of application deployments. This paper addresses this gap by conducting a comprehensive analysis of network misconfigurations in a Kubernetes cluster with specific reference to lateral movement. Accordingly, we carried out an extensive evaluation of 287 open-source applications belonging to six different organizations, ranging from IT companies and public entities to non-profits. As a result, we identified 634 misconfigurations, well beyond what could be found by solutions in the state of the art. We responsibly disclosed our findings to the concerned organizations and engaged in a discussion to assess their severity. As of now, misconfigurations affecting more than thirty applications have been fixed with the mitigations we proposed.

Various methods emerged to master the measurement challenge in this huge address space, including hitlists, new probing techniques, and AI-generated target lists. In this short paper, we apply active Subnet-Router anycast (SRA) probing, a commonly unused method to explore the IPv6 address space. We compare our results with lists of active IPv6 nodes obtained from prior methods and with random probing. Our findings indicate that probing an SRA address reveals on average 10\%~more router IP addresses than random probing and is far less affected by ICMP rate limiting. Compared to targeting router addresses directly, SRA probing discovers 80\% more addresses. We conclude that SRA probing is an important addition to the IPv6 measurement toolbox and may improve the stability of results significantly. We also find evidence that some active scans can cause harmful conditions in current IPv6 deployments, which we started to fix in collaboration with network operators.

Pivoting remains an economical and practical penetration method as it allows a malevolent actor to obtain access into a private network through compromised devices. There are a variety of tools both on the web and native to many operating systems, making pivoting simple to execute, even with limited system access. Preventing these attacks is traditionally performed with detection software running on end hosts or with perimeter devices, e.g., firewalls. However, not all end-host devices are under administrator control, and attackers are able to work around defences using SSH tunnels or obscuring their IP address. Rather than relying on middleboxes or end hosts, we leverage a programmable data plane for both their unique vantage point and traffic processing capabilities. Our system makes no assumptions about the underlying traffic and requires no cooperation from end hosts. We showcase Spotlight, a P4-based system that reliably intercepts pivoting attacks while raising only a small number of alarms. We develop a prototype system and demonstrate its effectiveness against various attacks on real-world traces.

Internet connectivity using low Earth orbit (LEO) satellites is gaining significant traction, with nearly 3 million users worldwide. While these networks promise to provide universal broadband connectivity, they suffer from large throughput fluctuations over short time scales. We conducted an extensive evaluation of Starlink’s throughput spanning three devices in different countries and six months. We identify various factors that cause throughput variations at varying timescales. Given our analysis, we design StarNet, a new learning-based throughput prediction system. StarNet incorporates satellite network-specific insights and accurately predicts future throughput for end users. We demonstrate that StarNet’s accurate predictions can improve the experience of end user applications like video streaming.

Machine learning (ML) models have emerged as the state-of-the-art approach for wireless applications such as transmitter localization. One of the challenges for ML models, however, is their reliance on the abundance of high quality data. Specifically for localization, a significant challenge is to obtain training data that ``covers'' the entire landscape, in order to ensure a high accuracy for the ML approaches. This issue is compounded when trying to localize multiple transmitters. To address this problem, we introduce a new data augmentation pipeline, termed Physics-informed Augmentation and RF Modeling (PhARMNet), that can combine existing data with a physics-based simulation model, producing a larger dataset with an improved coverage of the landscape of interest. Our results show that PhARMNet offers significant advantages over traditional path loss models. For localization, we demonstrate that augmenting training data with PhARMNet-produced samples improves localization accuracy, particularly in out-of-distribution regions and multi-transmitter settings.

The impending adoption of Open Radio Access Network (O-RAN) is fueling innovation in the RAN towards data-driven operation. Unlike traditional RAN where the RAN data and its usage is restricted within proprietary and monolithic RAN equipment, the O-RAN architecture opens up access to RAN data (i.e., network telemetry), via RAN intelligent controllers (RICs), to third-party machine learning (ML) powered applications – rApps and xApps – to optimize RAN operations. Consequently, a major focus has been placed on leveraging RAN data to unlock greater efficiency gains. However, there is an increasing recognition that RAN data access to apps could become a source of vulnerability and be exploited by malicious actors. Motivated by this, we carry out a comprehensive investigation of data vulnerabilities on both xApps and rApps, respectively hosted in Near- and Non-real-time (RT) RIC components of O-RAN. Our investigation begins by qualitatively analyzing the O-RAN security mechanisms and limitations relevant to xApps and rApps, such as their on-boarding authentication process and RIC database access mechanisms. Considering a threat model informed by this analysis, we design a viable and effective black-box evasion attack strategy targeting O-RAN RIC Apps while accounting for the stringent timing constraints (particularly for xApps) and attack effectiveness. The attack strategy employs four key techniques: the model cloning algorithm, input-specific perturbations, universal adversarial perturbations (UAPs), and targeted UAPs. This strategy targets ML models used by both xApps and rApps within the O-RAN system, aiming to degrade network performance. We experimentally validate the effectiveness of the designed evasion attack strategy and quantify the scale of performance degradation using a real-world O-RAN testbed and emulation environments. This evaluation is conducted using the Interference Classification xApp and the Power Saving rApp as representative applications for near-RT and non-RT RICs, respectively. Further, we show that the attack strategy is effective against prominent defense techniques for adversarial ML, such as defensive distillation and adversarial training.

The growing adoption of deep neural network (DNN) inference in mobile applications underscores the need for edge-assisted inference to meet the latency requirements of diverse DNN tasks given constrained device capabilities. However, widespread deployment remains hindered by unreliable latency due to the shared nature of cellular networks, where concurrent workloads contend across uplink, computation, and downlink stages. Although several approaches have been proposed, they primarily target specific tasks (e.g., video analytics) and lack support for diverse DNN tasks due to their uplink-centric designs.

This paper presents CORA, a system that serves latency-critical DNN inference requests on arrival, through end-to-end coordination between the radio access network (RAN) and the edge server. CORA dynamically adjusts the latency budgets across stages based on each DNN task’s characteristics, balancing resource demands for the radio and compute domains to mitigate contention at each stage. It then aligns the resource schedulers with these per-stage budgets, thereby enabling the end-to-end coordination without intrusive modifications. We prototype and evaluate CORA on an over-the-air testbed with diverse DNN tasks. CORA serves 3.2$\times$ more requests within the latency target and reduces the 95th percentile latency by 2.1$\times$ compared to baselines.

Programmable packet schedulers provide great flexibility in the ordering of packet transmission. They allow network operators to optimize crucial performance metrics, such as Flow Completion Time (FCT), using strategies that adapt to changes in the characteristics of incoming traffic. A challenge in programming these devices is that they are severely limited in registers, memory, and control flow operations. The popular scheduling strategy Push-In First-Out (PIFO), for example, cannot be straightforwardly implemented because it relies on sorting packets, which is difficult to implement at line speed on current hardware. Fixed-priority approximations of PIFO, like SP-PIFO and AIFO, do have hardware implementations but generally still do not scale well in, for example, the number of queues being used.

This paper introduces a new PIFO approximation strategy, Exp-PIFO, which prioritizes packets based on adaptive exponential prioritization criteria, called exponential bins. Exp-PIFO approximates the behavior of PIFO using only two memory cells to keep track of its state and uses a lookup table to avoid a complex control flow. We initially expected our improvement in memory and computation to come at a cost w.r.t. FCT performance compared to PIFO and its existing approximations. However, our empirical evaluation shows that Exp-PIFO sometimes even outperforms strict PIFO. We provide an explanation for this behavior and demonstrate the practical feasibility of Exp-PIFO through a proof-of-concept implementation on an Intel Tofino switch, which uses significantly less memory than comparable implementations of SP-PIFO and AIFO.

The live streaming landscape has shifted to a crowd-sourced paradigm, resulting in highly volatile and geographically diverse viewer demand. To handle growing traffic, Content Delivery Networks (CDNs) increasingly rely on a mix of dedicated infrastructure and lower-cost, heterogeneous edge resources. Our analysis of production data reveals two emerging characteristics in modern live delivery: dynamic regional supply-demand imbalance and per-stream heterogeneity in popularity and geography. However, existing request mapping solutions fall short in this new landscape, as they assume stable regional capacity and overlook stream-level heterogeneity.

This paper proposes LiveMap, a cost-efficient and latency-aware request mapping system for live CDNs. LiveMap performs online bandwidth provisioning via dual-level coordination to resolve regional supply-demand imbalances and reduce bandwidth costs. Further, LiveMap introduces an adaptive stream mapping strategy that dynamically forms per-stream delivery groups based on real-time popularity and system load.Deployed in a large-scale CDN serving crowdsourced live streaming over a year, LiveMap reduces bandwidth costs by 42.18\% and access latency by 20.26\%, outperforming the state-of-the-art solutions.

Large-scale edge Content Delivery Networks (CDNs) provide low-latency content access services and suffer from high bandwidth costs. While previous studies have sought to optimize bandwidth costs under percentile billing, the efficacy is compromised due to the pervasive uncertainty inherent in practical systems, including traffic demand dynamics, performance-constrained scheduling bias, and systemic scheduling deviations. Such uncertainties can result in large gaps among optimal, expected and actual utilization of massive vulnerable and heterogeneous edge nodes. To address these uncertainties, we propose Oceanus, a cost-effective traffic scheduling system for large-scale edge CDN systems. Oceanus decouples the bandwidth planning problem and performs on multiple timescales. In addition, Oceanus coordinates bandwidth planning with flow scheduling through the bidirectional feedback scheme. Oceanus further utilizes nodes with minimal marginal cost to reduce additional bandwidth cost. Extensive experiments in a trace-driven testbed and real-world deployment confirm the effectiveness of Oceanus. Compared to the state-of-the-art scheduling method, Oceanus achieves 79.4\% (vs. 51.5\%) of optimum cost reduction and reduces 21.4\% (vs. 8.1\%) bandwidth costs.

Time-Sensitive Networking (TSN) supports scheduling of periodic traffic in deterministic Ethernet networks. The Time-Aware Shaper (TAS) protects such traffic from lower-priority traffic by opening and closing corresponding queue gates in TSN switches, and Per-Stream Filtering and Policing (PSFP) accepts scheduled traffic only when arrived in expected intervals. Thus, TAS and PSFP are novel features in TSN switches that support time-triggered forwarding at a time scale of nanoseconds. As switch-internal forwarding delays are also at this time scale, their knowledge is needed for (1) the computation of schedules that define the transmission of Ethernet frames at Talkers, (2) the opening and closing of the Transmission Gates in TSN switches, and (3) the configuration of PSFP. While it is known that these delays exist and matter, they are not indicated on data sheets and there is no known methodology to derive them. This work fills this gap with T-Ray, a black-box measurement approach. That is, a delay model for TSN switches is proposed together with a measurement methodology to quantify the parameters of the delay model for a given TSN switch. The suggested gauging is illustrated with switches from Kontron and Relyum, and the results reveal significantly different operation delays.

BGP communities are widely used to encode routing metadata for traffic engineering, policy enforcement, and operational debugging. However, around 90% of observed communities lack public documentation, limiting their utility for research and operational analysis. Among these, city-level communities offer valuable geographic insight into routing behavior, yet remain largely untapped. In this paper, we develop a scalable method to infer the geographic meaning of undocumented city communities using BGP data. Applying our algorithm to data from May 2025, we infer the locations of 80% of city communities with a precision of 70 km or better. We validate our approach against a ground truth dataset covering 1,482 city communities and through operator feedback. Our findings uncover routing preferences at the city level and reveal cases of non-local routing behavior, such as remote peering. We will publish all code and datasets to support reproducibility and further research.

Geolocating network devices is essential for various research areas. Yet, despite notable advancements, it continues to be one of the most challenging issues for experimentalists. An approach for geolocating that has proved effective is leveraging geolocating hints in PTR records associated with network devices. We argue that Large Language Models (LLMs), rather than humans, are better equipped to identify patterns in DNS PTR records, and significantly scale the coverage of tools like Hoiho. We introduce an approach that leverages LLMs to classify PTR records, and generate regular expressions for these classes, and hint-to-location mapping. We present preliminary results showing the applicability of using LLMs as a scalable approach to leverage PTR records for infrastructure geolocation.

Layer-4 load balancer (LB) is one of the key building blocks of online services. In this paper, we empower such LBs to adapt to different and dynamic performance of backend instances (DIPs). Our system, KnapsackLB, is generic (can work with variety of LBs), does not require agents on DIPs, LBs or clients, and scales to large numbers of DIPs. KnapsackLB uses judicious active probes to learn a mapping from LB weights to the response latency of each DIP, and then applies Integer Linear Programming (ILP) to calculate LB weights that optimize latency, using an iterative method to scale the computation to large numbers of DIPs. Using testbed experiments and simulations, we show that KnapsackLB load balances traffic as per the performance and cuts average latency by up to 45% compared to existing designs.

Wi-Fi is an integral part of today's Internet infrastructure, enabling a diverse range of applications and services. Prior approaches to resource allocation in Wi-Fi optimized Quality of Service (QoS) metrics, which often do not accurately reflect the user's Quality of Experience (QoE). To address the gap between QoS and QoE, we introduce Maestro, an adaptive method that formulates the Wi-Fi resource allocation problem as a partially observable Markov decision process (PO-MDP) to maximize the overall system QoE and QoE fairness. Maestro estimates QoE without using any application or client data; instead, it treats them as black boxes and leverages temporal dependencies in network telemetry data. Maestro dynamically adjusts policies to handle different classes of applications and variable network conditions. Additionally, Maestro uses a simulation environment for practical training. We evaluate Maestro in an enterprise-level Wi-Fi testbed with a variety of applications. Our experimental results show that Maestro improves overall QoE by an average of 15% with maximum gains up to 80% while also enhancing QoE fairness.

While various spectrum sharing approaches aim to remedy the spectrum crunch and improve spectral utilization, they typically support only radios that are certified for and physically locked down to a single frequency band and power configuration. This limits their utility and re-usability as they do not support flexible license changes post-production, but there is generally no alternative \emph{dynamic} technical license enforcement mechanism suitable for more flexible SDRs (Software-Defined Radios). This limits the utility of SDRs, i.e., SDR operators are limited to using unlicensed bands, or to obtain special permission from the FCC via a manual process. Further, they are subject to fines if they operate outside these bounds and/or interfere with other spectrum users. Regulators and spectrum owners are thus rightly concerned about the protection of their licensed transmission rights, and introduction of new spectrum bands, sharing initiatives, and configurable SDRs for public use are often blocked as a result.

In response, we present SpectraCert---a dynamic, PKI-based (Public Key Infrastructure) system that enables safe, multi-faceted spectrum sharing while simultaneously enforcing license-holder rights directly within flexible transmitting radios. Entities receive specific frequency transmission rights from government authorities or other Spectrum-Authorized Entities (SAEs) through a \emph{spectracert}, which is a certificate that specifies allowed frequencies and all required transmission conditions, such as allowed times, geographic areas, max transmit powers, expirations and more. Spectracerts are derived from other spectracerts with increasingly limited transmission rights, and \emph{Trusted Modules} (TMs) within SDRs validate spectracert authenticity to ensure the rights defined by each parental spectracert are legal and have not been revoked. TMs only allow transmission according to validated spectracerts and control radio configurations. Spectracerts can also be used to verify SAE attestations of spectrum interference or occupancy reports.

We implement a prototype of the SpectraCert system with APIs that automatically revoke or replace spectracerts across SAE hierarchies when license updates occur, describe an integration with the OpenZMS spectrum management system, then evaluate how SpectraCert uniquely protects license rights while simultaneously allowing for more diverse, accessible spectrum sharing methods.

Volumetric video allows users 6 degrees of freedom (6-DoF) in viewing continuously evolving scenes in 3D. Given broadband speeds today, volumetric video conferencing will soon be feasible. Even so, these scenes will need to be compressed, and compression will need to adapt to variations in bandwidth availability. Existing 3D compression techniques cannot adapt to bandwidth availability, are slow, and utilize bandwidth inefficiently, so they don’t scale well to large scene descriptions. LiVo achieves low-latency and large-scene two-way conferencing by maximally leveraging existing 2D video infrastructure, including compression standards, rate-adaptive codecs, and real-time transport protocols. To achieve high quality, LiVo must carefully compose scenes from multiple cameras into multiple streams, encode scene geometry in a novel way, adapt to and apportion available bandwidth dynamically between streams to ensure high reconstruction quality, and cull content outside the receiver’s field of view to reduce information sent into the network. These novel contributions enable LiVo to outperform the state-of-the-art by over 20% in objective quality. In a user study, LiVo achieves a mean opinion score of 4.1, while other approaches achieve significantly lower values.

Internet of Things (IoT) Mobile Network Aggregators (MNAs) are an increasingly successful paradigm for providing ubiquitous mobile Internet connectivity for Smart Devices. They leverage the 4G/5G roaming architecture offered by Mobile Network Operators (MNOs) worldwide to offer a single gateway to the Internet. In this context, promptly detecting network outages is fundamental: Mobile Network Aggregators (MNAs) do not have control over the visited network infrastructure, and they offer connectivity to a huge number of possibly unmanaged devices. However, this activity is currently a painstaking process carried out manually by network engineers, who review trends in control plane signalling messages that are forwarded in the Mobile Network Aggregators (MNAs)’ managed core. In this paper, we present Faro, a self-supervised solution for the automatic detection of network outages. Faro leverages a contrastive learning framework that is particularly suited for this scenario, characterized by very skewed input data, few samples, and the use of confidence scores to automatically detect changes in the input data. We evaluate Faro using a real-world dataset comprising more than 5 million control plane messages across multiple countries and over 6 months, demonstrating its ability to accurately diagnose all outage scenarios in less than 15 minutes.

Long-range, high-capacity free-space optical communications (FSOC) is critical for terrestrial rural wireless x-haul and rural broadband in general. Existing terrestrial FSOC systems are however designed primarily for short-range communications. Long-range FSOC faces major challenges such as scintillation, weather, telescope misalignment, and sun noise, and there is a lack of FSOC systems and testbeds for investigating the feasibility and behavior of long-range, high-capacity terrestrial FSOC in realistic rural settings. To fill the gap, we design and implement R-Optical, a first-of-its-kind 10+ km FSOC x-haul system. We permanently deploy the R-Optical system and make it publicly available as the rural R-testbed for empowering researchers worldwide to investigate long-range FSOC and wireless x-haul solutions. The R-Optical system features innovative designs for addressing key challenges of long-range FSOC. It effectively uses optimized COTS components such as feedback-controlled-low-noise-amplifiers and transceivers compatible with conventional routers, and it invents a novel multi-level auto-alignment algorithm tailored for the R-Optical system. The software framework of the R-Optical system features custom-designed APIs and facilitates the establishment of the R-testbed for real-world experimentation. Using the field-deployed R-testbed, we demonstrate, for the first time, the real-world feasibility of long-range terrestrial FSOC. R-Optical achieves a maximum throughput of 2.92 Gbps on a single channel, and, with 16 parallel channels, R-Optical is well-poised to scale to an aggregate capacity of 160 Gbps using 10G SFP+ transceivers, with potential for multi-Tbps capacity using 100G/400G coherent transceivers. We also quantitatively characterize the impact of scintillation and weather on long-range terrestrial FSOC, and we will publicly share the first-of-its-kind measurement data. The unique lessons learned from this pioneering real-world deployment of long-range FSOC systems will also facilitate future real-world studies and adoption.

Virtual Reality (VR) cloud gaming systems render the 3D graphics on cloud servers for playing graphically demanding games on VR headsets. Delivering high-resolution game scenes is challenging due to variation in network performance. By leveraging the non-uniform human vision perception, foveated rendering and encoding have proven effective for optimized streaming in constrained networks. SoTA foveation methods either do not incorporate real-time gaze data or are unable to handle variations in network conditions, resulting in a suboptimal user experience. We introduce EyeNexus, a pioneering system that combines real-time gaze-driven spatial compression (FSC) with gaze-driven video encoding (FVE), transforming the gaze point for precise alignment and foveation. We propose a novel foveation model that dynamically adjusts the foveation region based on real-time bandwidth and gaze data. The model simplifies network-aware quality assignment in FVE, ensuring smooth and imperceptible quality gradients. We evaluate EyeNexus using objective and subjective measures with different network conditions and games. EyeNexus reduces latency by up to 70.9% and improves perceptual visual quality by up to 24.6%. Our IRB-approved user study shows that EyeNexus achieves the highest playability and visual quality, with improvements of up to 48%, while eliminating motion sickness.

With a budget of 300 cycles per packet, NFV scenarios necessitate efficient packet exchange mechanisms between NICs and CPUs. However, even the latest kernel bypass techniques, such as DPDK, can eat up 20% of the budget. This paper investigates the strain on CPUs due to escalating network speeds and the need to exchange more packet metadata as a result of NICs becoming more feature-fledged and "Smart". We advocate for NICs to adapt to software needs rather than rely on drivers as translators. We analyze different applications and compare multiple packet buffers and data organization models. We then develop an API for the datapath that will compile into different buffer management models according to the application's needs. Introducing ASNI, we explore the potential to tailor packet descriptors for different applications, offloading the driver's work from the datapath so that the application receives the packets precisely as it needs them. We advocate for a vision where only a minimal driver on the host is required, relieving CPU cycles that can be utilized to run applications instead. We propose a prototype implementation on NVIDIA Bluefield 3 SoC. Evaluated in multiple NFV scenarios, it manages to serve 2.2x more traffic under the same loss ratio constraints than state-of-the-art solutions.

High performance network switches are designed to meet peak throughput demands, always operating at maximum clock frequency to avoid packet drops. However, real-world network traffic exhibits clear periodic patterns, leading to a waste of energy due to over-provisioning during non-peak hours. Dynamic frequency scaling, a popular energy saving mechanism,was not adopted by network switches due to differences in architecture from CPUs and the requirement not to drop packets. In this paper, we present NetFridgeS, enabling dynamic frequency scaling on high-performance network switches. NetFridgeS builds upon carbonaware routing to forecast network utilization and adjust pipeline frequency. NetFridgeS is prototyped on FPGA using three distinct pipeline architectures, with sub-microsecond frequency switching times and minimal latency and resource overhead. By scaling down the frequency, NetFridgeS achieves an average energy saving of 77.74% at minimum throughput. In real network topologies, the combination of NetFridgeS and carbon aware routing results in up to a 22.11% reduction in overall energy consumption and a 27.76% reduction in carbon emissions compared with current network deployments.

To support high-performance network functions, recent work has explored hybrid architectures that combine the flexibility of general-purpose processors with the performance of the PISA architecture. These designs partition code and state between PISA platforms and general-purpose servers in pursuit of a "best of both worlds" design. However, integrating two separate platforms leads to the age-old challenge of ensuring high throughput and low latency while keeping distributed state consistent.

We propose a new, tightly-coupled architecture called SwitchNIC that guarantees consistent state between switch and general-purpose processor, while offering $99^{\text{th}}$ percentile packet latency of 6$\mu$s. The key to SwitchNIC's performance is a novel, "on-path" state replication protocol, with latency further tightened by implementing general-purpose processing on locally-integrated ARM cores. We prototype SwitchNIC by deploying its state replication algorithms on a Tofino switch with Ethernet-attached ARM-based SmartNICs. SwitchNIC achieves up to 5.2$\times$ better energy efficiency and 6.4$\times$ better processing latency than server-based systems, none of which completely and correctly support shared state between platforms.

Distributed machine learning (DML), such as large language model (LLM) training, has become one of the most critical services in multi-tenant cloud computing. However, communication contention among concurrent DML jobs significantly degrades overall GPU utilization, leading to inefficient training cluster performance. Existing approaches either achieve high performance at the cost of long scheduling runtime or reduce scheduling time at the expense of poor performance. We present \har, a novel two-tier scheduling framework that strikes a balance between scheduling latency and performance. It coordinates decisions between Local Schedulers and a lightweight Global Coordinator to enable scalable and adaptive scheduling. By combining rack-level epoch-based optimization with global coordination, \har alleviates communication contention and improves resource efficiency. We implement and evaluate \har on real distributed ML workloads running on a GPU testbed. Compared to state-of-the-art methods such as fair sharing, optimal scheduling, Crux, and Cassini, \har reduces training time by up to $33\%$ and communication time by up to $48\%$. Large-scale simulations show that it reduces scheduling time by up to $91\times$ while improving training time by $26\%$ in large-cluster settings.

Accurate and efficient inference on network traffic through machine learning models is important for many management tasks, from traffic prioritization to anomaly detection. Existing inference pipelines that use summary flow statistics (e.g., packet sizes, inter-arrival times) are efficient but less accurate, while those that apply representation learning to raw traffic captures are accurate but slow and resource-intensive. In this paper, we develop Just-in-Time Traffic Inference (JITI), a model serving system to support fast and accurate network traffic inference in representation learning-based inference pipelines. Offline, JITI builds a curated pool of diverse trained models with varied feature and performance requirements. Online, JITI responds to traffic fluctuations via an adaptive scheduler that selects the model from the pool that offers the highest accuracy-to-efficiency ratio within system resource limits, thereby providing inference accuracy comparable to the more complex and resource-intensive representation learning-based methods, with minimal efficiency compromise. Using traffic application inference as an example task, our evaluation shows that JITI improves inference performance by 18% over flow-statistics-based methods; when benchmarked against state-of-the-art representation learning-based methods, JITI results in a worst-case drop in F1-Score of only 12.3%, while reducing the average inference decision time by ~127x.

Congestion control (CC) is crucial for high-speed datacenter networks (DCNs), and CC frameworks are proposed to enable users to easily deploy new algorithms tailored to diverse scenarios. The framework is desired to be high-performance and generic: (i) allows CC to achieve high throughput and low latency, (ii) supports various algorithms and congestion scenarios. However, prior works either suffer from performance limitations or lack sufficient generality. For instance, CCP experiences throughput degradation under heavy traffic loads, while DOCA-PCC improves performance with hardware acceleration but lacks support for detecting and mitigating congestion within the host.

In this paper, we present Taurus, a high-performance and generic CC framework through hardware-software co-design. To achieve this, Taurus partitions CC functions into distinct tasks and maps them onto suitable hardware/software components while mitigating excessive communication overhead. Specifically, Taurus designs a collaborative signal collection mechanism to support diverse congestion feedback, a type-aware message report engine with two-tier aggregations to reduce communication overhead, and software built-in handlers to facilitate algorithm deployments. We have implemented a fully functional Taurus on commodity servers with FPGA-based NICs and deployed it into DCNs operating at 400Gbps. Experimental results show that Taurus supports various CC algorithms in achieving their near-native performance. Compared to CCP, Taurus improves throughput by 32.3%, reduces latency by 96.4%, and lowers CPU overhead by 158.7%. Compared to DOCA-PCC, Taurus improves throughput by 9.3% and reduces latency by 28.8%.

QUIC experiences a rapid adoption since its standardization in 2021, and major hypergiants configure their infrastructure to optimize for QUIC performance. In this paper, we introduce a passive measurement method to study both the progressive rollout and individual hypergiant configurations during the last five years. By analyzing backscatter traffic of the CAIDA network telescope, we are able to make the following observations. First, we can identify different off-net deployments of hypergiants, using packet features such as QUIC connection IDs, packet coalescence, and packet lengths. Second, Meta and Google configure significantly different maximal retransmission numbers and timeouts. Third, we observe changing hypergiant deployment configurations during our different measurement periods. Furthermore, the rollout procedure of a new configuration can be tracked solely from backscatter traffic. Fourth, SCIDs can allow further insights into load balancer deployments, such as the number of servers per load balancer. We bolster our results using two orthogonal measurements: active probing and passive recording of QUIC flows.

Pacing is a key mechanism in modern transport protocols, used to regulate packet transmission timing to minimize traffic burstiness, lower latency, and reduce packet loss. While the QUIC protocol recommends pacing and congestion control algorithms like BBR rely on it, the user-space nature of QUIC introduces unique challenges.

This paper investigates how pacing is implemented differently across QUIC stacks, including quiche, picoquic, and ngtcp2, and evaluates the impact of system-level features like GSO and Linux qdiscs on pacing. Using a custom measurement framework, we establish a baseline with default settings and systematically explore the effects of qdiscs, hardware offloading using the ETF qdisc, and GSO on pacing precision and network performance. We compare kernel-assisted and purely user-space pacing approaches. We show that pacing with only user-space timers can work well, as demonstrated by picoquic with BBR. We identify FQ as a qdisc well-suited for pacing QUIC traffic, as it is relatively easy to use and offers precise pacing based on packet timestamps. Our findings provide new insights into the trade-offs involved in implementing pacing in QUIC and highlight potential optimizations for real-world applications like video streaming and video calls.

The rapid growth of global modern Wide Area Networks (WANs) has posed significant challenges to traffic engineering (TE). Existing TE methods often struggle to balance optimality with tractability, while recent machine learning (ML)-based approaches fail to develop reliable strategies across diverse network scenarios. To address these issues, we introduce LO-TE, a novel TE solution integrating deep Learning and Optimization techniques. LO-TE operates in two phases: obtaining an initial solution and refining it to achieve a near-optimal TE solution. Our approach employs a scalable graph attention network for feature extraction, paired with a refining algorithm based on linear programming. We demonstrate the application of LO-TE on three typical TE problems.

We evaluate LO-TE on both real-world and self-generated large-scale topologies, finding that LO-TE show great generalizability over multiple TE problems and traffic models. Evaluation results show that LO-TE is several orders of magnitude faster than traditional TE methods, with a performance gap of less than 1% from the optimal solution. Furthermore, LO-TE outperforms state-of-the-art deep learning-based TE methods by satisfying 5%-20% more total traffic demands and achieving only 45%-63% maximum link utilization under drastically changing traffic conditions.

Non-terrestrial networks (NTNs) have been proposed as a key component of next generation of mobile networks. Satellite networks can potentially enable connectivity anywhere on earth, and modern satellites are capable of providing high throughput connectivity. However, there remains several open questions about how NTN will work in practice. We show that blindly applying terrestrial RAN architectures and connectivity management algorithms to the NTN context fails to deliver on multiple network and user level metrics. In this work we present an NTN system that takes a holistic view of the problem, considering both the radio access network architecture as well as the algorithms that drive user session orchestration in the face of satellite mobility. Using a realistic satellite emulation platform as well as large-scale simulations we show that our proposed system outperforms baseline solutions in simultaneously balancing multiple key performance indicators including throughput, coverage, and stability by reducing the impact of satellite mobility.

Obtaining an accurate, explainable and Internet scale IP geolocation dataset has been a longstanding goal of the research community. Despite decades of research on IP geolocation, no current technique can provide such a dataset. In particular, latency-based geolocation techniques do not scale, because, on one hand, we have thousands of available vantage points to perform measurements, but on the other hand, we have no way to select the right ones for each IP address. In this paper, we present GeoResolver, which is a serious step towards our goal, by using the idea that when multiple operators redirect two prefixes to the same servers, these prefixes should be close to each other. With this intuition, we define a methodology to measure and compare the redirection of prefixes to servers using ECS DNS measurements, and select the prefixes with the smallest redirection distance to a target prefix to issue the latency measurements to targets in that prefix. GeoResolver performs nearly as well as a brute force approach, geolocating 94% of the targets that could actually be geolocated at metro level, while using 4.3% of the probing budget compared to the state of the art. On the Internet scale CAIDA ITDK dataset, GeoResolver geolocates 16% of the IP addresses at metro level, 3.4 times more than the state of the art. In addition, GeoResolver is robust to public resolvers or hypergiants stopping supporting ECS.

DNS is one of the cornerstones of the Internet. Nowadays, a substantial fraction of DNS queries are handled by public resolvers (e.g., Google Public DNS and Cisco’s OpenDNS) rather than ISP nameservers. This behavior makes it difficult for authoritative nameservers to provide answers based on the requesting resolver. The impact is especially important for entities that make client origin inferences to perform DNS-based load balancing (e.g., CDNS). The EDNS0 Client Subnet (ECS) option adds the client’s IP prefix to DNS queries, which allows authoritative nameservers to provide prefix-based responses.In this study, we introduce a new method for conducting ECS scans, which provides insights into ECS behavior and significantly reduces the required number of queries by up to 97 % compared to state-of-the-art techniques. Our approach is also the first to facilitate ECS scans for IPv6. We conduct a comprehensive evaluation of the ECS landscape, examining the usage and implementation of ECS across various services. Overall, 53 % of all nameservers support prefix-based responses. Furthermore, we find that Google nameservers do not comply with the Google Public DNS guidelines. Lastly, we plan to make our tool, and data publicly available to foster further research in the area.

CCAnalyzer is a recent proposal for a congestion control algorithm (CCA) classifier to measure the deployment of congestion control algorithms in the Internet today by creating a controlled bottleneck and monitoring bottleneck queue occupancy between third-party websites and a controlled receiver. However, this work was designed for web traffic, whereas most internet traffic today is video streaming. Video streaming applications pose additional challenges in CCA classification due to the interactions between adaptive bitrate (ABR) algorithms and CCAs. In this work, we present VCCAnalyzer, which addresses these challenges by carefully selecting bottleneck bandwidth rates to minimize ABR interference and applying interpolation and smoothing techniques to create classifiable queue occupancy traces. VCCAnalyzer achieves 100\% accuracy, higher accuracy than other approaches in video classification. To demonstrate the efficacy of VCCAnalyzer, we conduct a measurement study examining the CCA deployment across major streaming platforms, including Disney+, Hulu, Twitch, and other commonly visited websites. Our findings reveal some variations in congestion control strategies between these services. Our results demonstrate that VCCAnalyzer can effectively classify CCAs in video environments.

Nostr is a decentralized social network launched in 2022, emphasizing high availability and censorship resistance. Since launching, it has gained substantial attention, boasting over 100 million posts. From a user's perspective, it is similar to a micro-blogging service like Twitter. However, the underlying systems infrastructure is very different, and Nostr boasts a range of unique features that set it apart. Nostr introduces the concept of relays, which act as open storage servers that receive, store, and distribute user posts. Each user is uniquely identified by a public key, ensuring authenticity of posts through digital signatures. Users are able to securely replicate and retrieve posts through multiple relays, which frees them from single-server reliance and enhances post availability, thereby attempting to make Nostr censorship resistant. However, this aggressive design also presents challenges, such as the overhead required for extensive post replication and the difficulty in obtaining a global view of post replication locations, which remain unexplored or unaddressed. This necessitates a thorough understanding of the Nostr ecosystem; therefore, we conduct the first large-scale study on this topic. Our study focuses on two key aspects: Nostr relays and post replication strategies. We find that Nostr achieves superior decentralization compared to traditional Fediverse applications. However, relay availability remains a challenge, where financial sustainability (particularly for free-to-use relays) emerges as a contributing factor. We also find that the replication of posts across relays enhances censorship-resistance but introduces significant overhead. To address this, we propose two improvements: one to control the number of post replications, and another to reduce the overhead during post retrieval. Via a data-driven evaluation, we demonstrate their ability to reduce overhead without negatively impacting post availability.