How measurements run
Users submit programs to run on nodes hosted by operators. A trusted coordinator manages measurement schedules, attribution keys, and traffic limits. Targets are the hosts that receive probes.
- User
Submit a program
Write a WebAssembly measurement program and specify the targets you want to measure.
- Coordinator
Schedule the work
The coordinator schedules measurements, manages attribution keys, and allocates traffic limits.
- Measurement node
Run and tag probes
Nodes run the program in a sandbox and attach a cryptographic tag to each probe.
- Recipient
Check the traffic
After the keys are released, recipients can check captured probe tags and request exclusion.
From packet to program
Nodes attach a cryptographic tag to each probe. After a delay, they release the key needed to check that tag against the program that sent it.
Check a capture
The verification tool checks packet tags in your browser using the published keys. Keep the original capture and its timestamps: attribution depends on observing packets before their keys are released.
A shared limit for each target
Programs measuring the same destination share a traffic budget. The coordinator distributes that budget across nodes to limit the combined probe rate.
Trust assumptions
The design treats measurement programs as untrusted. It assumes a trusted coordinator and operators that follow the protocol, known as semi-honest operators. These assumptions define the scope of its protections.
See the Debuglet and TRACER publicationsfor the research behind the platform. Implementation guides are in preparation.