Measurement · what the encryption took
Per-subscriber quality after QUIC

Three in four of your subscribers
cannot be measured.

Every per-subscriber quality metric in this industry reads TCP: segments, retransmissions, reordering, timestamp RTT. QUIC is now roughly two thirds of download traffic and carries none of it. This is what that does to a monitoring system, measured on a live fleet — including ours.

A subscriber nobody could measure and a subscriber with nothing wrong produce exactly the same record. Same shape, same fields, no fault. One of them is fine.

59–67%
of download bytes are QUIC
69.9%
of active subscribers unjudgeable
0
future versions that fix it
5,565
of 7,967 measured live, one fleet

What actually happened

Loss detection works by watching a transport admit that it lost something. TCP does this in the clear: a retransmitted segment carries a sequence number you have already seen, so a device in the middle can count it without decrypting anything.

QUIC encrypts and authenticates its packet numbers. There is no sequence number in the clear, no visible retransmission, no duplicate acknowledgement. A middlebox cannot count what it cannot see, and no amount of engineering changes that — it is a design goal of the protocol, not an oversight in it.

What a gateway can and cannot see TCP traffic exposes sequence numbers and retransmissions, so loss is countable in the middle. QUIC protects its packet numbers, so retransmission is invisible and loss cannot be counted at all. TCP — about a third of the bytes sequence numbers in the clear retransmissions countable from the middle reordering and RTT both observable measurable QUIC — the other two thirds packet numbers encrypted and authenticated no visible retransmission, ever spin bit disabled by deployed stacks unmeasurable — permanently This is not a limitation of any one vendor's probe. It is the transport doing what it was designed to do, and it applies identically to every device that is not an endpoint.

We checked the escape route. There isn't one.

QUIC has a "spin bit" — one unencrypted bit that toggles once per round trip, deliberately left visible so the path can estimate RTT. On paper it is the answer. We measured it on the wire.

Measured on live trafficResultReading
QUIC flows with a toggling spin bit2 of 960 — 0.2%Stuck at zero on 99.8% of flows. Deployed stacks disable it.
Negative control: QUIC fixed bit100.0%The probe reads the header correctly.
Negative control: adjacent protected bits49–51% randomEncryption is where we expect it. The probe is sound.

The controls matter more than the headline. Without them, "the spin bit is always zero" is indistinguishable from "our probe is broken". With them, the conclusion is solid: the bit is off because the world turned it off, and planning a product around it would be planning around something that is not there.

The number that should worry an operator

Coverage is not evenly spread. Some subscribers still carry enough TCP to judge; most do not. Measured across a production fleet, counting only subscribers actually moving download traffic — idle ones are excluded, because they are unjudgeable for a boring reason:

Judgeable versus unjudgeable subscribers Of 7,967 subscribers moving download traffic, 2,402 carried enough TCP to score and 5,565 did not. The unjudgeable ones produce records identical to healthy subscribers. 2,402 judgeable 30.1% 5,565 cannot be judged at all 69.9% Both halves are moving real traffic. Only the left half can be given a verdict. On a conventional dashboard the right-hand block is rendered green — not because anything was checked and passed, but because no fault was raised. Absence of a finding is being displayed as a finding of health.

And it is worst exactly when you would trust it most. Coverage depends on load. When a gateway is quiet, the little TCP that exists is thin and scattered, and every box we measured converged to about three quarters blind. Under load they spread apart and the busiest improved most — one moved from 74.8% blind to 64.6%. The overnight "no faults found" report is the least trustworthy report your system produces. Scheduled health sweeps at 3am are measuring the hour with the least evidence in it.

The rule we encoded, and it has one direction

Low coverage invalidates a negative, never a positive. A fault found on 5% of a subscriber's bytes is a real fault on a real line — show it, do not grey it out, do not down-rank it. "No fault found" on a subscriber nobody could see is not a clean bill of health. The clean bill is the thing that needs labelling, not the fault.

Two states versus three A conventional dashboard has only fault and healthy, so everything unmeasured is rendered healthy. Adding a third state, not measurable, moves the unmeasured population out of the healthy column where it never belonged. CONVENTIONAL fault healthy …and everything nobody could measure ← the unmeasured hide in here WHAT WE RENDER fault healthy not measurable stated in words, with the share we could see ← named, not assumed The third box is not a new metric. It is the population that was always there, moved out of a column it never belonged in.

What a dashboard usually shows

Two states. Fault, or healthy. Everything that did not raise a fault is rendered as healthy, because there is nowhere else to put it.

The subscriber whose line is degrading and whose traffic happens to be 97% QUIC lands in the healthy column and stays there until they telephone.

What ours shows

Three. Fault, healthy, and not measurable — the last stated in words, with the share of traffic the verdict rests on attached to every per-subscriber finding.

A gateway that cannot run the detector at all says so on the dashboard instead of showing an empty panel that reads as "no broken lines".

A dashboard panel headed Lines Needing Attention. It states that 5,136 of 7,232 subscribers moving traffic could not be assessed, 71 percent, mostly QUIC.
The box-level statement, on the operator's dashboard. Not a percentage buried in a report — a sentence saying how many subscribers moving real traffic the system was unable to assess, next to the faults it did find. The header states the same thing about the estate: 6 of 80 gateways can report. A gateway that cannot run the detector says so rather than contributing a silent zero.
A subscriber fault banner reading MAJOR MIXED, both signatures present, not localised, with 11.9 percent loss over 32,954 segments judged and an amber badge reading seen on 1 percent of traffic.
And on every individual verdict. This fault rests on 32,954 judged segments — which sounds like plenty until the badge tells you it is 1% of what that subscriber actually moved. The fault is still shown in full, at full severity, because a fault found on 1% of the bytes is a real fault. What the badge changes is the confidence attached to its size — and it would have changed the meaning entirely had the same subscriber shown no fault at all.

What we will not claim

Never coming

QUIC loss and reordering

Packet numbers are header-protected. Loss is unobservable from the middle by design, and no future release changes that. Anyone promising per-subscriber QUIC loss from a network device is describing something else.

Refuted

Spin-bit RTT

0.2% of flows on the wire. We tested it, it failed, and we are not building on it. Published here so nobody re-derives the same dead end from the specification.

Bounded

Where a fault lives

These are transit measurements. On most flagged subscribers there is no access-leg sample behind the verdict, so it says the path is losing packets — not that the customer's line is at fault.

That last one cost us a wording change across the product. A loss verdict used to say "the fault is on the physical line" and advise dispatch. It could not support that: the measurement is taken in transit. It now names the signature and stops where the evidence stops. Sending a technician against a fault you have not localised is the expensive half of being wrong.

Where this leaves the numbers you already have

Not everything degrades equally. The verdicts a system does produce can still be sound, and on the fleet we measured, most are: of 160 open faults, 155 rested on more than a quarter of the subscriber's traffic — many on nearly all of it — and only 5 were thin enough to caveat.

The blindness is not in what gets flagged. It is in what never does. That is a far more comfortable position to be in, and it is only knowable because the coverage figure exists. Without it, "155 solid findings and 5 shaky ones" and "160 findings of unknown quality" look the same from outside.

What changed after this was written

Everything above remains true of detectors that read the subscriber's traffic, and the QUIC facts are permanent. But the conclusion people drew from it — that those subscribers simply cannot be measured — turned out to be a limit of the method, not of the problem.

There is a second signal, and encryption never touched it. Every PPPoE router sends the gateway a keepalive on its own schedule. Measuring that instead gives a per-subscriber quality reading regardless of what the traffic is made of. On the gateway where the traffic-reading stack had data for zero subscribers, the new one had it for 1,132 — and it locates the fault rather than merely detecting one. Answering where, not whether →

That does not retire this document. The coverage figures here are what the traffic-reading detectors can still see, the QUIC facts still bound what any middlebox can ever observe, and the rule that gives this page its title is unchanged: an unmeasured subscriber must never be rendered as a healthy one. The new measurement widens what can be judged; it does not make the honesty optional.

The bottom line

Encryption removed a measurement the whole industry was quietly relying on, and most monitoring has not noticed, because the failure mode is silence rather than error. Nothing breaks. No alert fires. The screens stay green.

We would rather hand you a system that says "we could not see two thirds of this subscriber's traffic" than one that says nothing and lets you infer everything is fine. Ask your current vendor what share of your subscribers they can actually measure. The answer is a number, they should have it, and if they do not have it that is itself the answer.

About the figures. Coverage, QUIC share and spin-bit results are measured on a production fleet carrying live subscriber traffic, not on a test bench. Counts are per-measurement-tick gauges and describe the instant they were taken; the blind share is expressed as a proportion of subscribers moving download traffic, which excludes idle subscribers. No operator, site or subscriber identifier appears anywhere in this document.