The support ticket arrives before the release notes do: a filter log where some rows carry hostnames and some carry only an IP address, from the same handset within the same hour.
That unevenness is in the design. ECH is on by default from API level 37, but an app only gets it if its networking library can do the work, which is why Google pointed developers at OkHttp 5.5.0 [6][7]. The library has to pull the ECH configuration out of a DNS HTTPS record and set it before the handshake starts [8], and the far end has to have provisioned an ECH public key on its origin, reverse proxy or CDN and made it discoverable in DNS [9]. Miss any link and the connection falls back to a conventional TLS handshake with the SNI visible again [9]. The connections that go dark on your filter are the intersection of two upgrade schedules, neither of which sits on your change calendar [2].
Diagnosing why a connection went dark turns out to be harder than the outage itself. When a destination server does not support ECH, Android's documented approach includes ECH GREASE, which permits an ordinary TLS connection while making protected ones harder to spot [10]. An inventory built by counting ECH-shaped handshakes will overcount [3].
ECH does not hide everything. ECH is not a VPN, and observers can still see destination IP, timing, traffic volume and the broad hosting or content-delivery network involved, while DNS requests stay in the open [11], which is why Google's own framing pairs ECH with Private DNS [12]. Address-layer and DNS-layer controls keep reading the same fields they always did, while controls built to read the hostname lose that data [1].
Carriers, not IT departments, control when the 2G change takes effect. Android 12 gave users a radio-level toggle they had to find for themselves; Android 17 lets participating carriers switch 2G off by default for subscribers [14]. According to ZDNet, none of the three major US carriers still support 2G, while most carriers in the UK and India do, along with much of Europe and many countries in the Global South [15]. SMS blasters work that seam by broadcasting a signal strong enough to persuade a nearby phone to abandon LTE or 5G, then pushing phishing texts past newer network-side anti-spam measures [16]. For a fleet in those markets, the fix lands when the carrier decides, not when the device updates [4].
Two other items get a sentence each in ZDNet's account: local-network permissions are now enforced, and Certificate Transparency is enabled by default [5][4]. The writeup does not say whether that enforcement reaches certificates chaining to enterprise-installed roots [5], which is the detail that decides whether a TLS-inspecting proxy still works on Monday. Google's claim is about being first among mobile operating systems [1]; desktop browsers have supported ECH for years [17], and ZDNet's caveat is that ECH is still being rolled out, so a connection from a supporting phone may still be unsafe [13].
Every network control you run reads one field. Each control can be classified by which field it reads and by whether the fleet owns the end that supplies that field. Hostname rules on Android 17 now depend on parties you do not employ, and the rules that were quietly living on SNI will look broken without anyone having changed them.
