Methodology
Overview of our methodology, comprising an active approach (left) to assess current ECN awareness across servers and network paths, and a passive approach (right) for longitudinal analysis.
Active Measurements
We use active measurements to characterize ECN awareness among web servers and network element interference along Internet paths. Vantage points We use seven vantage points, all Amazon AWS servers, spanning all continents: Asia (India), Europe (Sweden), South America (Brazil), Oceania (Australia), Africa (South Africa), and North America (with two locations in the United States).
Measurement tools
- PathSpider. We employed PathSpider to assess ECN awareness among web servers through active TCP handshake probing.
- Scamper. We used Scamper to investigate the treatment of ECN markings along Internet paths and identify potential network interference.
- ZDNS. We used ZDNS to resolve domain names and enumerate the associated server endpoints.
Datasets
- Tranco List. We used the Tranco top 1 million domains as a large-scale dataset of popular websites to evaluate ECN deployment across widely used web infrastructure.
- University Websites. We included university domains to complement the Tranco dataset with websites hosted in academic networks, which may differ from commercial environments in their deployment and operational practices.
- Arbitrary Prefixes List. We constructed a dataset of IPv4 and IPv6 prefixes using BGP routing information from RIPE RIS and prefix allocations from the Internet Routing Registry (IRR). By selecting one random address per prefix, we obtained a diverse set of targets for evaluating ECN behavior across a broad range of Internet paths and networks.
ASN and Organization Mapping
- pyasn. We used pyasn together with Route Views routing information base (RIB) snapshots to map IP addresses and prefixes to their originating Autonomous Systems (ASes).
- Route Views. We used routing information base (RIB) snapshots from the Route Views Project as the source of BGP routing data required for IP-to-ASN mapping.
- AS-to-Organization Dataset. We used the AS-to-Organization dataset to map ASNs to the organizations that operate them, enabling analysis beyond the network level.
- GeoLite ASN Database. We used the GeoLite ASN database as an additional source of ASN and organization information to complement the primary mappings and improve coverage.
Passive Measurements
To complement active measurements, we analyzed passive datasets spanning transit and client networks, providing a longitudinal view of ECN adoption and usage in the Internet.
Datasets
- MAWI Dataset (2007–2025). We used monthly snapshots from the MAWI traffic traces between January 2007 and July 2025 to study ECN deployment and usage from a transit-network perspective.
- M-Lab NDT Dataset (2021–2025). We used monthly snapshots of M-Lab Network Diagnostic Tool (NDT) measurements collected between August 2021 and August 2025 to analyze ECN negotiation and usage in residential and mobile networks across IPv4 and IPv6.
Measurement tools
- Zeek. We used Zeek to generate connection logs from the MAWI dataset’s pcap traces. Since Zeek does not natively record ECN support or IP ToS flags, we extended it to extract and log this information.
- bgp.tools Network-Type Tags.. We used bgp.tools network-type annotations to classify ASes and distinguish residential ISP and mobile networks in the M-Lab analysis.
Further results on DNS resolutions
We have provided a high level stats on the DNS resolutions of the Tranco and university websites in the paper, to complement these results we provide more details on the results of the resolutions and ASN and organization mapping. Rather than resolving domain names to one or two IP addresses, we sought to enumerate the serving infrastructure as comprehensively as feasible. To this end, we used ZDNS, a modular, opensource DNS resolver toolkit designed for resolving millions of domains efficiently. We configured ZDNS to resolve each domain name in our dataset using 17 different EDNS client subnet (ECS) queries, each with a different /24 subnet, from a single vantage point in Europe. Each subnet corresponds to an IP address from a well-known European VPN provider. We further issued these queries against two public recursive DNS resolvers, Quad9 and Google. In aggregate, we issued 34,328,916 DNS queries. Each additional ECS query reveals a non-trivial number of /24 IPv4 and /48 IPv6 prefixes, although the fraction of newly discovered prefixes diminishes gradually. For enumerating the different networks, however, a few ECS prefixes suffice for the most part. Of the 1,003,876 domains in our dataset, 893,947 (89.0%) resolved to at least one IP address. Of these, 268,979 (30.09%) resolved to both IPv4 and IPv6 addresses; 624,805 (69.89%) resolved only to IPv4 addresses, while a small fraction (0.02%, or 163 domains) resolved only to IPv6.
Resolution stats.
- Tranco. Among the top one million Tranco domains, 885,682 successfully resolved to at least one IP address. Of these, 30.12% (268,481) resolved to both IPv4 and IPv6 addresses, 69.86% (622,671 ) resolved only to IPv4, and a small fraction, 0.02% (172), resolved exclusively to IPv6. This resulted in a total of 614,323 unique IPv4 addresses (229,087 prefixes) and 1,434,928 unique IPv6 addresses (10,748 /48 prefixes and 294,585 /64 prefixes). Overall, by applying both techniques described above, we identified 22,690 ASNs.
- World Universities List. Using the same methodology applied to the Tranco dataset, we successfully resolved 6,059 out of 7,719 domains from the World Universities list. These correspond to 13,244 unique IP addresses (8,764 IPv4 and 4,114 IPv6), which map to 5,661 (or 8,238 if we consider /64) network prefixes (5,169 IPv4 and 485 IPv6 /48 and 2789 IPv6 /64 ) and are associated with 1,742 unique ASNs.
- U.S. Universities List. We successfully resolved 16,56 out of 1,955 domains from the U.S. Universities list. These yielded 4,085 unique IP addresses (3,168 IPv4 and 917 IPv6), which correspond to 1,877 (2367) network prefixes (1,740 IPv4 and 137 /48 IPv6 627 /64) and are associated with 435 unique ASNs.
- Overlap Analysis. However, a significant portion of these domains overlap with those already present in the Tranco list. Specifically, 61.0% of the World Universities domains and 81.1% of the U.S. Universities domains are already covered by the Tranco dataset. This overlap results in 73.2% and 81.9% of the IP addresses, respectively, being shared with Tranco, meaning that 97.4% and 95.0% of the ASNs discovered in the university lists had already been observed when resolving the Tranco list.
Domain–IP Stats.
a. CDF of number of IPs per domain.
b. CDF of number of domains per IP.
c. CDF of number of prefixes per domain(/24 for IPv4 and /64 for IPv6)
d. CDF of number of domains per prefix
(/24 for IPv4 and /64 for IPv6)
Figure 1. Relationship between domains, IP addresses, and network prefixes.
-
On average, each domain resolves to 4.55 IPv4 and 8.73 IPv6 addresses.
However, the median drops to 1 and 4 for IPv4 and IPv6, respectively. At the 95th percentile,
each domain resolves to 7 IPs in both versions. The long tail of this distribution appears
clearly in Fig. 1(a). During our resolution period, we observed malware
domains such as sikelocci.com, which resolved to 1,276 IPv4 addresses and had no IPv6 counterparts.
In Fig. 1(b), we show the number of domains associated with each IP address
for both versions. In the median case, each IP address corresponds to a single domain; however, certain
IP addresses e.g., one of Cloudflare IPs mapped to more than 60,000 domains in both versions.
On average, each domain resolves to 2.54 IPv4 (/24) and 7.68 IPv6 (/64) prefixes.
These numbers differ in the median, which are 1 and 3, respectively. As shown in Fig. 1(c),
the top 20 domains resolve to 270 prefixes. Nevertheless, the statistics for the number of domains per prefix
differ. As shown in Fig. 1(d), the top 20 prefixes host more than 1,000
(IPv4) and 3,000 (IPv6)
domains. However, the mean and median values are much lower—9.87 and 1 domain per IPv4 prefix, and 6.98 and 1 per
IPv6 prefix,
respectively.
ASN stats.
a. IPs per ASN.
b. Prefixes per ASN.
c. Domains per ASN.
d. ASNs per domain.
Figure 2. Relationship domains, IP addresses, and perefixes with ASNs.
-
Fig. 2(a) presents the CDF of ASNs per IP address. On average,
each ASN hosts 27.21 IPv4 and 392.39 IPv6 addresses; however, the median values are considerably
lower—2 and 1, respectively. As shown in Fig. 2(a)
and Fig. 2(b), the long tail of the CDF indicates that a small number
of ASNs possess disproportionately larger address counts compared to the median.
Fig. 3(a), and Fig. 3(b),
illustrate the ten ASNs with the highest numbers of unique IPv4 and IPv6 addresses, respectively.
As can be observed, the leading ASN, Amazon-16509, holds more than 131 K IPv4 and 1 M IPv6
addresses. Predictably, a similar trend appears in the distribution of prefixes, as depicted in
Fig. 3(c)
and Fig. 3(d). Domains follow the same trend as
IP addresses and prefixes. Fig. 2(c) shows the CDF of
domains per ASN. On average, each ASN hosts 40.70 domains that resolve to IPv4
and 74.64 domains that resolve to IPv6 addresses, while the corresponding median values
are 2 and 3, respectively. As shown in Fig. 4(a)
and Fig. 4(b) , the top ASN—Cloudflare 13335—hosts
more than 250K and 200K domains associated with IPv4 and IPv6 addresses, respectively.
a. ASNs by unique IPv4 addresses.
b. ASNs by unique IPv6 addresses.
c. ASNs by unique IPv4 prefixes (/24).
d. ASNs by unique IPv6 prefixes (/64).
Figure 3. Top 10 ASNs ranked by the number of unique IPv4 addresses, IPv6 addresses, IPv4 prefixes (/24), and IPv6 prefixes (/64) associated with the resolved domains.
a. ASNs by domains (IPv4).
b. ASNs by domains (IPv6).
Figure 4. Top 10 ASNs ranked by the number of domains associated with IPv4 and IPv6 addresses.
-
Fig. 5(a) shows the top 10 ASN with the highest number
of IPv4-only domains. Amazon and Cloudflare are among the ASN hosting
the largest number of domains that successfully resolved to IP addresses. However, there is a
notable difference between them in terms of IPv6 deployment: for Amazon, 91% of domains
resolved only to IPv4, whereas this percentage is much lower for Cloudflare,
with only 19% of its domains being IPv4-only.
Examining the top TLDs in Fig. 5(b), it is unsurprising that .com ranks first among IPv4-only domains. Nevertheless, 66% of .com domains are IPv4-only, indicating that 34% are dual-stacked. This ratio is substantially worse for the next nine TLDs, which exhibit even higher proportions of IPv4-only domains.
a. ASNs
b. TLDs
Figure 5. Top (a) ASNs and (b) TLDs by number of domains that resolved to IPv4 but not to IPv6. The ratio of IPv4-only domains is shown above each bar.
ECS DNS gain.
-
To enumerate web servers as comprehensively as possible, we issued DNS queries using 17 distinct EDNS Client Subnet (ECS) values, each corresponding to a different /24 subnet associated with IP addresses from a major European VPN provider. All measurements were conducted from a single European vantage point and directed to two public recursive DNS resolvers, Google Public DNS and Quad9. In total, we issued 34,328,916 DNS queries.
The results are summarized in Fig. 6 , which compares the overlap and gain achieved by each ECS configuration relative to the ECS instance that discovered the largest number of items. Subfigures (a), (b), (c), and (d) present the results for domains, IP addresses, network prefixes, and ASNs, respectively. Positive values indicate items discovered by the reference ECS instance but missed by the target ECS instance, whereas negative values indicate items uniquely discovered by the target ECS instance. Overall, each additional ECS query reveals a non-trivial number of previously undiscovered domains, IP addresses, prefixes, and ASNs, although the marginal gain decreases progressively as more ECS values are employed Fig. 7.
a. Domains
b. IP addresses (IPv4 and IPv6)
c. Prefixes (/24 for IPv4 and /64 for IPv6)
d. ASNs
Figure 6. Comparing the overlap of (a) domains, (b) IP addresses, (c) network prefixes, and (d) ASNs with the ECS DNS instance that discovered the highest number of items (domains resolution/IP/Prefix/ASNs). Positive values indicate cases where the reference ECS DNS instance discovered items that the target ECS DNS instance did not, while negative values indicate cases where the target ECS DNS instance discovered items missed by the reference instance.
a. Newly discovered domains
b. Newly discovered IP addresses
c. Newly discovered prefixes
d. Newly discovered ASNs
Figure 7. Cumulative gain obtained from issuing DNS queries with multiple ECS prefixes. The figure shows the number of newly discovered (a) domains, (b) IP addresses, (c) network prefixes, and (d) ASNs as additional ECS values are incorporated into the enumeration process.