About

Fabian E. Bustamante is a Professor of Computer Science at Northwestern University, based in the McCormick School of Engineering. His research focuses on experimental investigations of Internet-scale computer networks and distributed systems. He emphasizes improving the visibility of measurement on networked systems, leveraging this insight to characterize network infrastructure and design improved systems. His work aims to enhance understanding of network behavior and infrastructure, contributing to the development of more resilient and efficient network systems.

Research topics

• Computer Science
• Telecommunications
• Computer Security
• Computer network
• Engineering
• World Wide Web
• Embedded system
• Geography

Selected publications

• En Unión y Libertad: Subnational Strategies for Hosting Government Services

  Lecture notes in computer science · 2026-01-01

  book-chapterSenior author
  PublisherDOI

• Monitoring Latency on Submarine Cables: Limitations and Opportunities

  Open MIND · 2026-01-01

  articleOpen access

  The world’s Submarine Cable Network (SCN) is a critical component of the Internet, supporting both inter- and intra- continental communication. We describe a methodology to extract packet latency (via RTT) information on submarine segments, using existing deployed infrastructure collecting standard traceroute measurements. The first component of the methodology identifies vantage points whose measurements traverse submarine segments. The second component provides novel, path-change-aware, approaches to extract the minRTT over the segments, using those vantage points. We demonstrate the efficacy of our method by using traceroute measurements from perfSONAR deployments as ground truth. Our results provide a clear view of the inherent limitations of existing deployed infrastructure. Although both our methodology and minimum RTT estimators raise the state of the art, they also reveal that such infrastructure cannot hope, in general, to access dynamic latency metrics such as latency variability (variance) arising from congestion.

  PublisherDOI

• Who Holds the Steering Wheel? Opacity and Consolidation in CDN Replica Selection

  Open MIND · 2026-01-01

  articleOpen access

  Replica selection, the process by which CDNs decide which server delivers content, has become a hidden lever of power and fragility in today’s Internet. Most users, operators, and policymakers remain blind to how these decisions are made, yet they shape latency, resilience, and sovereignty at global scale. DNS resolver centralization further distorts this function, concentrating influence in the hands of a few global actors. We present the first methodology to systematically infer CDN replica selection strategies at global scale, enabling third-party visibility into opaque steering mechanisms. Using RIPE Atlas probes and a geographically distributed set of DNS resolvers, we construct latency fingerprints that distinguish DNS-based, anycast, and regional anycast deployments. We validate our approach on well-documented global providers before applying it to a diverse set of 17 global and regional CDNs serving the top 1,000 websites across 19 countries, covering 66% of Internet users. We also examine ECS support and its interaction with DNS-based redirection. Our findings show that DNS-based steering remains the dominant approach, used by over 70% of CDNs and responsible for most delivered bytes, yet regional variation and mixed strategies complicate the picture. These results highlight replica selection not only as a technical optimization, but as a sociotechnical risk: opaque steering decisions, particularly among regional CDNs, amplify the effects of resolver consolidation and shape the Internet’s future resilience and control.

  PublisherOA PDFDOI

• Learning AS-to-Organization Mappings with Borges

  2025-10-15

  articleOpen access

  We introduce Borges (Better ORGanizations Entities mappingS), a novel framework for improving AS-to-Organization mappings using Large Language Models (LLMs). Existing approaches, such as AS2Org and its extensions, rely on static WHOIS data and rule-based extraction from PeeringDB records, limiting their ability to capture complex, dynamic organizational structures. Borges overcomes these limitations by combining traditional sources with few-shot LLM prompting to extract sibling relationships from free-text fields in PeeringDB, and by introducing website-based inference using redirect chains, domain similarity, and favicon analysis. Our evaluation shows that Borges outperforms prior methods, achieving a 7% improvement in sibling ASN identification and an Organization Factor score of 0.3576. It also expands the recognized user base of large Internet conglomerates by 192 million users (≈ 5% of the global Internet population) and improves geographic footprint estimates across multiple regions.

  PublisherOA PDFDOI

• A Comparative Analysis of Global Mobile Network Aggregators

  IEEE Transactions on Network and Service Management · 2025-01-01

  article

  The mobile telecommunication industry is undergoing continuous evolution to cope with ever increasing service requirements and expectations of end users. This has recently led to the rise of Mobile Network Aggregators (MNAs), a new type of global virtual operators that deliver mobile communication services by utilizing multiple Mobile Network Operators (MNOs), dynamically connecting to the one that best meets their customers’ needs based on location and time. MNAs can then offer optimized global coverage by connecting to local MNOs that have limited (e.g., national) geographic service. In this paper, we provide a first in-depth analysis of the operations of three major MNAs: Google Fi, Twilio, and Truphone. We conduct performance measurements across these MNAs for critical applications spanning DNS, web browsing, and video streaming, and compare their performance against that of a traditional MNO from two very diverse geographical locations, US and Spain. We find that MNAs may introduce some delay compared to local MNOs in the region where the user is roaming, yet they offer significant performance improvements over the traditional MNOs roaming model, such as home-routed roaming. To fully assess the potential benefits of the MNA model, we also carry out emulation studies assessing the potential performance gains that MNAs could achieve by deploying both control and user plane functions of open-source 5G implementations across different Amazon Web Services locations.

  PublisherDOI

• Threading the Ocean: Mapping Digital Routes Across Submarine Cables using Calypso

  2025-08-27 · 1 citations

  articleOpen accessSenior author

  The Internet's connectivity relies on a fragile submarine cable network (SCN), yet existing tools fall short in assessing its criticality. We introduce Calypso, a new framework that leverages traceroute data to map traffic to submarine cables. Validated through real-world case studies, Calypso reveals hidden risks and offers new insights to enhancing SCN resilience.

  PublisherOA PDFDOI

• Towards Stress Testing the Internet Inter-Domain Routing System ‘in Silico’ with Domino

  2025-09-29

  article

  In just a few decades, the Internet has evolved from a research prototype to a cyber-physical infrastructure of critical importance for modern society and the global economy. Surprisingly, despite its new role, the survivability of the Internet-its ability to fulfill its mission in the presence of large-scale failures-has received limited attention. We introduce Domino, our initial design and implementation of a testbench tool for stress testing the Internet's routing system, a key element of the critical Internet infrastructure. The simulation-based testbench consists of a comprehensive and flexible framework that allows for the incorporation of diverse survivability metrics, provides a platform for specifying, evaluating, and comparing different topologies of the underlying Internet infrastructure, and can account for modifications to networking protocols and architectural components. By demonstrating the utility of the proposed testbench with a number of illustrative examples, we make a case for stress testing as a viable approach to evaluating the Internet's survivability in the face of evolving challenges.

  PublisherDOI

• Are Leo Networks the Future of National Emergency Failover? – a Quantitative Study and Policy Blueprint

  SSRN Electronic Journal · 2025-01-01 · 1 citations

  articleOpen access
  PublisherDOI

• Take the Long Way Home—Distant Peering to the Cloud

  IEEE Transactions on Networking · 2025-08-23

  article

  The emergence of large cloud providers in the last decade has transformed the Internet, resulting in a seemingly ever-growing set of datacenters, points of presence, and network peers. Despite the availability of closer peering locations, some networks continue to peer with cloud providers at distant locations, traveling thousands of kilometers. In this paper, we employ a novel cloud-based traceroute campaign to characterize the distances networks travel to peer with the cloud. This unique approach allows us to gain unprecedented insights into the peering patterns of networks. Our findings reveal that 50% of the networks peer within 300 kilometers of the nearest datacenter. However, our analysis also reveals that over 20% of networks travel at least 6,700 kilometers beyond the proximity of the nearest computing facility, and some as much as 18,791 kilometers! While these networks connect with the cloud worldwide, from South America to Europe and Asia, many come to peer with cloud providers in North America, even from Oceania and Asia. We explore possible motivations for the persistence of distant peering, discussing factors such as cost-effective routes, enhanced peering opportunities, and access to exclusive content.

  PublisherDOI

• The Aleph: Decoding Geographic Information from DNS PTR Records Using Large Language Models

  Proceedings of the ACM on Networking · 2025-03-05 · 1 citations

  articleOpen accessSenior author

  Geolocating network devices is essential for various research areas. Yet, despite notable advancements, it continues to be one of the most challenging issues for experimentalists. An approach for geolocating that has proved effective is leveraging geolocating hints in PTR records associated with network devices. Extracting and interpreting geo-hints from PTR records is challenging because the labels are primarily intended for human interpretation rather than computational processing. Additionally, a lack of standardization across operators -- and even within a single operator, due to factors like rebranding, mergers, and acquisitions -- complicates the process. We argue that Large Language Models (LLMs), rather than humans, are better equipped to identify patterns in DNS PTR records, and significantly scale the coverage of tools like Hoiho. We introduce The Aleph, an approach and system for network device geolocation that utilizes information embedded in PTR records. The Aleph leverages LLMs to classify PTR records, generate regular expressions for these classes, and establish hint-to-location mapping per operator. We present results showing the applicability of using LLMs as a scalable approach to leverage PTR records for infrastructure geolocation.

  PublisherOA PDFDOI

Recent grants

• NeTS: Small: A Dual-Objective Platform for Internet Experimentation

  NSF · $416k · 2012–2016

• CAREER: Ensuring Sustainable Scalability for Globally-Distributed Systems

  NSF · $424k · 2007–2012

• Collaborative Research: CNS Core: Medium: On the Criticality of the Submarine Cable Network

  NSF · $735k · 2021–2025

• NeTS: Small: Broadband Service Reliability: Characterization and Improvement

  NSF · $366k · 2016–2021

• NeTS: Small: Parallax -- Leveraging the Perspective of Ten Million Peers

  NSF · $500k · 2009–2012

Frequent coauthors

• David Choffnes

  30 shared

• John P. Rula

  Akamai (United States)

  23 shared

• Zachary S. Bischof

  Georgia Institute of Technology

  23 shared

• John S. Otto

  20 shared

• Karsten Schwan

  Delft University of Technology

  19 shared

• Mario A. Sánchez

  Autonomous University of Tlaxcala

  16 shared

• S. Birrer

  Northwestern University

  12 shared

• Greg Eisenhauer

  10 shared

Labs

• AquaLabPI