# Encrypted Client Hello Is Coming: A View from Passive Measurements
## 3 Dataset and Methodology  
Our dataset was passively collected from a medium-sized university campus with approximately 35,000 students. The campus network is connected to the internet via two bidirectional 10 Gbit/s access links, providing connectivity to students and staff via Wi-Fi and Ethernet cable access. The campus organization operates an internal DNS resolver, which (i) is used as the local resolver by internal users and (ii) is the authoritative name server for the campus DNS zones (the campus operates two second-level DNS domains, and this DNS server is authoritative for both ). The university does not support IPv6 addressing; therefore, all observed traffic is IPv4-based. While we expect client behavior regarding ECH to be consistent across IP versions, due to its origin in the application layer, this remains an open area for further study. Notice that our dataset, collected from a single university campus network, reflects the behavior of a specific user demographic--primarily students, faculty, and staff--whose device types, application usage, and network configurations may differ from those in residential or corporate environments. As such, our findings may not fully generalize to other network contexts, particularly where DNS policies or middlebox deployments differ significantly. We deploy a passive measurement infrastructure depicted in Figure 1. We collected data using a passive monitor deployed at the campus edge and connected to the router via four span ports that mirror the router's traffic. The monitor uses the DPDK library ([[https://www.dpdk.org/](https://www.dpdk.org/)]([https://www.dpdk.org/](https://www.dpdk.org/))) for packet capture and runs Tstat [18], a passive monitoring tool that records details of observed TCP and UDP flows. Tstat is open-source and available online ([[http://tstat.polito.it/](http://tstat.polito.it/)]([http://tstat.polito.it/](http://tstat.polito.it/))). It is highly configurable and can produce log files regarding a number of events observed in the network. Specifically, for each TCP or UDP connection, Tstat tracks IP addresses and port numbers, as well as several metrics extracted from the Deep Packet Inspection (DPI) of the flow packets. It can produce other types of log files regarding HTTP, DNS, or RTP traffic. In the following paragraphs, we describe the fields relevant to our analyses. We gather data for the full month of February 2025 and analyze the log file related to DNS and QUIC traffic. We run queries on the logs using DPMon, a differentially private query engine for passive network measurements developed in our previous work [19] and released as open source at [[https://github.com/marty90/DPMon](https://github.com/marty90/DPMon)]([https://github.com/marty90/DPMon](https://github.com/marty90/DPMon)), accessed on 4 August 2025. DPMon runs directly on the probe. We leverage the following three datasets:  
* _Outgoing DNS:_ We record all DNS transactions initiated by the campus resolver to answer queries by internal clients. To this end, Tstat has been configured to produce a \"DNS log\" which records all the DNS transactions observed in the traffic. Indeed, all internal clients are configured to use the internal DNS resolver, which answers the client's recursive queries by contacting the required authoritative DNS servers. Our setup allows us to observe DNS traffic between the internal resolver and the internet, but we cannot record the individual DNS requests/responses issued by clients. Thus, we can collect the whole set of domains accessed by internal clients, but we cannot link them to the corresponding user. Moreover, some requests might be handled by the DNS server thanks to the cache, without the need for issuing any query to the external authoritative name server. For DNS transactions, Tstat exports the endpoint IP addresses and port numbers as well as the queries and resource records carried within packets. For each one, Tstat reports the domain name, DNS record type (A, AAAA, HTTPS, etc. ), and the content of the record.