The Lockdown Effect: Implications of the COVID-19 Pandemic on - - PowerPoint PPT Presentation

▶
the lockdown effect implications of the covid 19 pandemic
SMART_READER_LITE
LIVE PREVIEW

The Lockdown Effect: Implications of the COVID-19 Pandemic on - - PowerPoint PPT Presentation

Jan 22, 2024 334 likes •1.32k views

The Lockdown Effect: Implications of the COVID-19 Pandemic on Internet Traffic Narseo Vallina-Rodriguez (IMDEA Networks) and Juan Tapiador (UC3M) Jornadas REDIMadrid 2020 20 Oct 2020 Lots of data, lots of data crunchers Anja Feldmann Oliver

slide-1
SLIDE 1

The Lockdown Effect: Implications of the COVID-19 Pandemic on Internet Traffic

Narseo Vallina-Rodriguez (IMDEA Networks) and Juan Tapiador (UC3M)

Jornadas REDIMadrid 2020 Š 20 Oct 2020

slide-2
SLIDE 2

Lots of data, lots of data crunchers

Anja Feldmann MPII Daniel Wagner DE-CIX Oliver Gasser MPII Matthias Wichtlhuber DE-CIX Franziska Lichtblau MPII Juan Tapiador Universidad Carlos III de Madrid Enric Pujol BENOCS Narseo Vallina Rodriguez IMDEA Networks, ICSI Ingmar Poese BENOCS Oliver Hohlfeld Brandenburg University

  • f Technology

Christoph Dietzel DE-CIX Georgios Smaragdakis TU Berlin, MPII

1

slide-3
SLIDE 3

COVID-19 and the Internet

slide-4
SLIDE 4

COVID-19 and the Internet

2

slide-5
SLIDE 5

COVID-19 and the Internet

2

slide-6
SLIDE 6

COVID-19 and the Internet

2

slide-7
SLIDE 7

COVID-19 and the Internet

2

slide-8
SLIDE 8

COVID-19 and the Internet

The Internet is essential in all these efforts, but how well does it cope?

2

slide-9
SLIDE 9

Goals of this presentation

  • Understand the impact of the COVID-19 pandemic on different

networks

3

slide-10
SLIDE 10

Goals of this presentation

  • Understand the impact of the COVID-19 pandemic on different

networks

  • Present our results from a diverse set of vantage points

3

slide-11
SLIDE 11

Goals of this presentation

  • Understand the impact of the COVID-19 pandemic on different

networks

  • Present our results from a diverse set of vantage points
  • Highlight how a change in user demand affects traffic dynamics

3

slide-12
SLIDE 12

Vantage points

slide-13
SLIDE 13

4

slide-14
SLIDE 14

3 IXPs

IXP Central Europe IXP Southern Europe IXP US East Coast

4

slide-15
SLIDE 15

3 IXPs

IXP Central Europe IXP Southern Europe IXP US East Coast

Interconnecting networks

4

slide-16
SLIDE 16

IXPs: Central Europe, Southern Europe, US East Coast

  • Central Europe: 900+ members, 8+ Tbps peak traffic
  • Southern Europe: 170+ members, 500+ Gbps peak traffic
  • US East Coast: 250+ members, 600+ Gbps peak traffic
  • IPFIX flows collected at the public peering platforms

Data has been analyzed strictly on premise and results are aggregated.

5

slide-17
SLIDE 17

ISP 3 IXPs

IXP Central Europe IXP Southern Europe IXP US East Coast Central Europe

Interconnecting networks

6

slide-18
SLIDE 18

ISP 3 IXPs

IXP Central Europe IXP Southern Europe IXP US East Coast Central Europe

Residential customers working from home Interconnecting networks

6

slide-19
SLIDE 19

Large European ISP

  • Services ∼15M fixed line subscribers + Tier 1 transit network
  • No hosted CDN caches, but a diverse peering infrastructure
  • Subscriber view: Netflow captured at the Border Network Gateways

(BNGs)

  • AS level view: Netflow collected at the border routers

Data has been analyzed strictly on premise and results are aggregated.

7

slide-20
SLIDE 20

ISP 3 IXPs EDU

IXP Central Europe IXP Southern Europe IXP US East Coast Central Europe

Residential customers working from home

Madrid region

Interconnecting networks

8

slide-21
SLIDE 21

ISP 3 IXPs EDU

IXP Central Europe IXP Southern Europe IXP US East Coast Central Europe

Service network interconnecting universities and research institutions Residential customers working from home

Madrid region

Interconnecting networks

8

slide-22
SLIDE 22

REDIMadrid university network

  • Academic network interconnecting 16 universities and research

centers (Madrid region)

  • Serves ∼290K users (including WiFi access, student halls, etc)
  • NetFlow captured at the border routers

The network operators provided anonymized flow data.

9

slide-23
SLIDE 23

Analyzing the pandemic across time

Our analysis is based on four weeks representing the course of the pandemic from February 2020 to June 2020.

10

slide-24
SLIDE 24

Analyzing the pandemic across time

base: February before the lockdown Our analysis is based on four weeks representing the course of the pandemic from February 2020 to June 2020.

10

slide-25
SLIDE 25

Analyzing the pandemic across time

base: February before the lockdown March: During the lockdown Our analysis is based on four weeks representing the course of the pandemic from February 2020 to June 2020.

10

slide-26
SLIDE 26

Analyzing the pandemic across time

base: February before the lockdown March: During the lockdown April: First relaxation of restrictions Our analysis is based on four weeks representing the course of the pandemic from February 2020 to June 2020.

10

slide-27
SLIDE 27

Analyzing the pandemic across time

base: February before the lockdown March: During the lockdown April: First relaxation of restrictions June: Minimum restiction level Our analysis is based on four weeks representing the course of the pandemic from February 2020 to June 2020.

10

slide-28
SLIDE 28

Analyzing the pandemic across time

base: February before the lockdown March: During the lockdown April: First relaxation of restrictions June: Minimum restiction level ISP-CE IXP-CE IXP-SE IXP-US EDU base Feb 20–26 Feb 20–26 Feb 20–26 Feb 20–26 Feb 20–26 March Mar 19–25 Mar 19–25 Mar 12–18 Mar 19–25 Mar 12–18 April Apr 09–15 Apr 23–29 Apr 23–29 Apr 23–29 Apr 23–29 June Jun 18–24 Jun 18–24 Jun 18–24 Jun 18–24 n/a Our analysis is based on four weeks representing the course of the pandemic from February 2020 to June 2020.

10

slide-29
SLIDE 29

Traffic changes in different networks

slide-30
SLIDE 30

Traffic changes January 2019 to June 2020

2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 Calendar week 0.6 0.8 1.0 1.2 1.4 1.6 Normalized traffic volume COVID-19 outbreak in Europe Initial responses and lockdowns

ISP, Europe (>15M fixed-network lines)

11

slide-31
SLIDE 31

Traffic changes January 2019 to June 2020

2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 Calendar week 0.6 0.8 1.0 1.2 1.4 1.6 Normalized traffic volume COVID-19 outbreak in Europe Initial responses and lockdowns

ISP, Europe (>15M fixed-network lines)

Once the lockdown started the ISP saw an increase in traffic which normally spans over multiple months.

11

slide-32
SLIDE 32

Traffic changes January 2019 to June 2020

2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 Calendar week 0.6 0.8 1.0 1.2 1.4 1.6 Normalized traffic volume COVID-19 outbreak in Europe Initial responses and lockdowns

ISP, Europe (>15M fixed-network lines) IXP, Central Europe (>900 members) IXP, South Europe (>170 members) IXP, US East Coast (>250 members)

11

slide-33
SLIDE 33

Traffic changes January 2019 to June 2020

2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 Calendar week 0.6 0.8 1.0 1.2 1.4 1.6 Normalized traffic volume COVID-19 outbreak in Europe Initial responses and lockdowns

ISP, Europe (>15M fixed-network lines) IXP, Central Europe (>900 members) IXP, South Europe (>170 members) IXP, US East Coast (>250 members)

Similar behaviour for the IXPs; for the IXP CE and IXP US the traffic levels keep elevated.

11

slide-34
SLIDE 34

Traffic changes January 2019 to June 2020

2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 Calendar week 0.6 0.8 1.0 1.2 1.4 1.6 Normalized traffic volume COVID-19 outbreak in Europe Initial responses and lockdowns

ISP, Europe (>15M fixed-network lines) IXP, Central Europe (>900 members) IXP, South Europe (>170 members) IXP, US East Coast (>250 members) Mobile operator, Europe (>40M customers)

11

slide-35
SLIDE 35

Traffic changes January 2019 to June 2020

2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 46 48 50 52 54 56 58 60 62 64 66 68 70 72 74 76 78 80 Calendar week 0.6 0.8 1.0 1.2 1.4 1.6 Normalized traffic volume COVID-19 outbreak in Europe Initial responses and lockdowns

ISP, Europe (>15M fixed-network lines) IXP, Central Europe (>900 members) IXP, South Europe (>170 members) IXP, US East Coast (>250 members) Mobile operator, Europe (>40M customers)

Once the lockdown started mobile traffic decreased measurably and increases with the first relaxations in mid April.

11

slide-36
SLIDE 36

Traffic volumes before and after the lockdown

Day of Week Normalized Traffic Volume 2 4 6 8 10 Thu Fri Sat Sun Mon Tue Wed Base: 2020−02−20 2020−02−26

12

slide-37
SLIDE 37

Traffic volumes before and after the lockdown

Day of Week Normalized Traffic Volume 2 4 6 8 10 Thu Fri Sat Sun Mon Tue Wed Base: 2020−02−20 2020−02−26 March: 2020−03−19 2020−03−25

12

slide-38
SLIDE 38

Traffic volumes before and after the lockdown

Day of Week Normalized Traffic Volume 2 4 6 8 10 Thu Fri Sat Sun Mon Tue Wed Base: 2020−02−20 2020−02−26 March: 2020−03−19 2020−03−25 30% peak increase

12

slide-39
SLIDE 39

Traffic volumes before and after the lockdown

Day of Week Normalized Traffic Volume 2 4 6 8 10 Thu Fri Sat Sun Mon Tue Wed Base: 2020−02−20 2020−02−26 March: 2020−03−19 2020−03−25 April: 2020−04−09 2020−04−15

12

slide-40
SLIDE 40

Traffic volumes before and after the lockdown

Day of Week Normalized Traffic Volume 2 4 6 8 10 Thu Fri Sat Sun Mon Tue Wed Base: 2020−02−20 2020−02−26 March: 2020−03−19 2020−03−25 April: 2020−04−09 2020−04−15 June: 2020−06−18 2020−06−24

12

slide-41
SLIDE 41

Lockdown: Change in workday vs. weekend pattern (ISP)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Hour of the day 0.0 0.2 0.4 0.6 0.8 1.0 Normalized traffic volume Wednesday Feb 19 13

slide-42
SLIDE 42

Lockdown: Change in workday vs. weekend pattern (ISP)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Hour of the day 0.0 0.2 0.4 0.6 0.8 1.0 Normalized traffic volume Wednesday Feb 19 Saturday Feb 22 13

slide-43
SLIDE 43

Lockdown: Change in workday vs. weekend pattern (ISP)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Hour of the day 0.0 0.2 0.4 0.6 0.8 1.0 Normalized traffic volume Wednesday Feb 19 Saturday Feb 22

  • Regular patterns

13

slide-44
SLIDE 44

Lockdown: Change in workday vs. weekend pattern (ISP)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Hour of the day 0.0 0.2 0.4 0.6 0.8 1.0 Normalized traffic volume Wednesday Feb 19 Saturday Feb 22

  • Regular patterns
  • Workday: Strong increase in evening hours
  • Weekend: More traffic during daytime

13

slide-45
SLIDE 45

Lockdown: Change in workday vs. weekend pattern (ISP)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Hour of the day 0.0 0.2 0.4 0.6 0.8 1.0 Normalized traffic volume Wednesday Feb 19 Saturday Feb 22 Wednesday Mar 25 (lockdown)

  • Regular patterns
  • Workday: Strong increase in evening hours
  • Weekend: More traffic during daytime

13

slide-46
SLIDE 46

Lockdown: Change in workday vs. weekend pattern (ISP)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Hour of the day 0.0 0.2 0.4 0.6 0.8 1.0 Normalized traffic volume Wednesday Feb 19 Saturday Feb 22 Wednesday Mar 25 (lockdown)

  • Regular patterns
  • Workday: Strong increase in evening hours
  • Weekend: More traffic during daytime
  • During pandemic: Workdays look more like weekends

13

slide-47
SLIDE 47

Changes in workday vs. weekday patterns at the ISP

  • Classify days into workdays or weekends using traffic patterns

14

slide-48
SLIDE 48

Changes in workday vs. weekday patterns at the ISP

  • Classify days into workdays or weekends using traffic patterns
  • Pre-lockdown: Most days are classified correctly

14

slide-49
SLIDE 49

Changes in workday vs. weekday patterns at the ISP

  • Classify days into workdays or weekends using traffic patterns
  • Pre-lockdown: Most days are classified correctly
  • During lockdown: Many workdays are classified as weekends

14

slide-50
SLIDE 50

Changes in workday vs. weekday patterns at the ISP

  • Classify days into workdays or weekends using traffic patterns
  • Pre-lockdown: Most days are classified correctly
  • During lockdown: Many workdays are classified as weekends;

recovering after mid-May

14

slide-51
SLIDE 51

Changes in workday vs. weekday patterns: ISP vs. IXP

ISP

Jan 1 Feb 1 Mar 1 Apr 1 May 1 Jun 1 Date 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

Sat-Sun Mon-Fri 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

with weekend-like pattern

}

with workday-like pattern

}

Mon-Fri Sat-Sun

IXP

Jan 1 Feb 1 Mar 1 Apr 1 May 1 Jun 1 Date 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

Sat-Sun Mon-Fri 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

with weekend-like pattern

}

with workday-like pattern

}

Mon-Fri Sat-Sun

15

slide-52
SLIDE 52

Changes in workday vs. weekday patterns: ISP vs. IXP

ISP

Jan 1 Feb 1 Mar 1 Apr 1 May 1 Jun 1 Date 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

Sat-Sun Mon-Fri 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

with weekend-like pattern

}

with workday-like pattern

}

Mon-Fri Sat-Sun

IXP

Jan 1 Feb 1 Mar 1 Apr 1 May 1 Jun 1 Date 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

Sat-Sun Mon-Fri 0.00 0.25 0.05 0.75 1.00

  • Norm. traffic volume

with weekend-like pattern

}

with workday-like pattern

}

Mon-Fri Sat-Sun

  • Workdays are also mostly classified as weekends at the IXP

15

slide-53
SLIDE 53

Classify traffic by application class

  • Classification: transport ports and AS based

16

slide-54
SLIDE 54

Classify traffic by application class

  • Classification: transport ports and AS based
  • Normalize traffic to min/max of three weeks

16

slide-55
SLIDE 55

Classify traffic by application class

  • Classification: transport ports and AS based
  • Normalize traffic to min/max of three weeks
  • No change in early morning hours → remove

16

slide-56
SLIDE 56

Classify traffic by application class

  • Classification: transport ports and AS based
  • Normalize traffic to min/max of three weeks
  • No change in early morning hours → remove

Thu Fri Sat Sun Mon Tue Wed

C D N E d u c a t i

  • n

a l S

  • c

i a l m e d i a G a m i n g V

  • D

E m a i l C

  • l

l . w

  • r

k i n g W e b c

  • n

f

Base week ISP

T h u F r i S a t S u n M

  • n

T u e W e d

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Base week IXP

16

slide-57
SLIDE 57

Classify traffic by application class

  • Classification: transport ports and AS based
  • Normalize traffic to min/max of three weeks
  • No change in early morning hours → remove

Thu Fri Sat Sun Mon Tue Wed

C D N E d u c a t i

  • n

a l S

  • c

i a l m e d i a G a m i n g V

  • D

E m a i l C

  • l

l . w

  • r

k i n g W e b c

  • n

f

Base week ISP

T h u F r i S a t S u n M

  • n

T u e W e d

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Base week IXP

  • Email during working hours

16

slide-58
SLIDE 58

Classify traffic by application class

  • Classification: transport ports and AS based
  • Normalize traffic to min/max of three weeks
  • No change in early morning hours → remove

Thu Fri Sat Sun Mon Tue Wed

C D N E d u c a t i

  • n

a l S

  • c

i a l m e d i a G a m i n g V

  • D

E m a i l C

  • l

l . w

  • r

k i n g W e b c

  • n

f

Base week ISP

T h u F r i S a t S u n M

  • n

T u e W e d

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Base week IXP

  • Email during working hours
  • CDN, VoD, gaming and social media during evening hours

16

slide-59
SLIDE 59

Classify traffic by application class

  • Classification: transport ports and AS based
  • Normalize traffic to min/max of three weeks
  • No change in early morning hours → remove

Thu Fri Sat Sun Mon Tue Wed

C D N E d u c a t i

  • n

a l S

  • c

i a l m e d i a G a m i n g V

  • D

E m a i l C

  • l

l . w

  • r

k i n g W e b c

  • n

f

Base week ISP

T h u F r i S a t S u n M

  • n

T u e W e d

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Base week IXP

  • Email during working hours
  • CDN, VoD, gaming and social media during evening hours
  • Hardly any web conferencing

16

slide-60
SLIDE 60

Changes in application classes: Central European ISP

Thu Fri Sat Sun Mon Tue Wed

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Central European ISP −− Downstream Diff1: March − Base

−100 −90 −80 −70 −60 −50 −40 −30 −20 −10 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

17

slide-61
SLIDE 61

Changes in application classes: Central European ISP

Thu Fri Sat Sun Mon Tue Wed

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Central European ISP −− Downstream Diff1: March − Base

−100 −90 −80 −70 −60 −50 −40 −30 −20 −10 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

March:

  • Large increase in web

conf., coll. working, educational traffic

  • Partial decrease in

VoD and gaming

17

slide-62
SLIDE 62

Changes in application classes: Central European ISP

Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Central European ISP −− Downstream Diff1: March − Base Diff2: April − Base

−100 −90 −80 −70 −60 −50 −40 −30 −20 −10 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

March:

  • Large increase in web

conf., coll. working, educational traffic

  • Partial decrease in

VoD and gaming

17

slide-63
SLIDE 63

Changes in application classes: Central European ISP

Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Central European ISP −− Downstream Diff1: March − Base Diff2: April − Base

−100 −90 −80 −70 −60 −50 −40 −30 −20 −10 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

March:

  • Large increase in web

conf., coll. working, educational traffic

  • Partial decrease in

VoD and gaming April:

  • Growth in Email less

pronounced

  • Decrease in social

media

17

slide-64
SLIDE 64

Changes in application classes: Central European ISP

Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Central European ISP −− Downstream Diff1: March − Base Diff2: April − Base Diff3: June − Base

−100 −90 −80 −70 −60 −50 −40 −30 −20 −10 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

March:

  • Large increase in web

conf., coll. working, educational traffic

  • Partial decrease in

VoD and gaming April:

  • Growth in Email less

pronounced

  • Decrease in social

media

17

slide-65
SLIDE 65

Changes in application classes: Central European ISP

Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed Thu Fri Sat Sun Mon Tue Wed

CDN Educational Social media Gaming VoD Email

  • Coll. working

Web conf

Central European ISP −− Downstream Diff1: March − Base Diff2: April − Base Diff3: June − Base

−100 −90 −80 −70 −60 −50 −40 −30 −20 −10 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

March:

  • Large increase in web

conf., coll. working, educational traffic

  • Partial decrease in

VoD and gaming April:

  • Growth in Email less

pronounced

  • Decrease in social

media June:

  • Web conf. still growing,

but more focused on working hours

  • Moderate growth in coll.

working

  • Decrease of VoD, gaming

and social media

17

slide-66
SLIDE 66

Changes in application classes: Central European IXP

18

slide-67
SLIDE 67

Changes in application classes: Central European IXP

March:

  • Increase in web conf., VoD,

and gaming

  • Partial decrease in CDN and

educational traffic

18

slide-68
SLIDE 68

Changes in application classes: Central European IXP

March:

  • Increase in web conf., VoD,

and gaming

  • Partial decrease in CDN and

educational traffic

18

slide-69
SLIDE 69

Changes in application classes: Central European IXP

March:

  • Increase in web conf., VoD,

and gaming

  • Partial decrease in CDN and

educational traffic April & June:

  • Strong increase in web conf.
  • Decrease in CDN and social

media traffic

18

slide-70
SLIDE 70

Changes in application classes: Central European IXP

March:

  • Increase in web conf., VoD,

and gaming

  • Partial decrease in CDN and

educational traffic April & June:

  • Strong increase in web conf.
  • Decrease in CDN and social

media traffic

18

slide-71
SLIDE 71

Changes in application classes: Central European IXP

March:

  • Increase in web conf., VoD,

and gaming

  • Partial decrease in CDN and

educational traffic April & June:

  • Strong increase in web conf.
  • Decrease in CDN and social

media traffic

18

slide-72
SLIDE 72

Case Study: Gaming traffic at a Southern European IXP

02-16 02-23 03-01 03-08 03-15 03-22 03-29 04-05 04-12 04-19 04-26 week 0.0 1.0 2.0 3.0 4.0 5.0 normalized unique IPs IXP SE

local lockdown COVID-19

  • utbreak

traffic per hour daily minimum daily maximum daily average

19

slide-73
SLIDE 73

Case Study: Gaming traffic at a Southern European IXP

02-16 02-23 03-01 03-08 03-15 03-22 03-29 04-05 04-12 04-19 04-26 week 0.0 1.0 2.0 3.0 4.0 5.0 normalized unique IPs IXP SE

local lockdown COVID-19

  • utbreak

traffic per hour daily minimum daily maximum daily average

  • Gaming: Large increase in number of active IP addresses and traffic

volume

19

slide-74
SLIDE 74

VPN traffic: Central European IXP

VPN identification

  • Port-based: Well known port/proto combinations exclusively used by

VPN services

  • DNS-based: For TCP/443 traffic, IPs labeled *vpn*, but not www.

20

slide-75
SLIDE 75

VPN traffic: Central European IXP

VPN identification

  • Port-based: Well known port/proto combinations exclusively used by

VPN services

  • DNS-based: For TCP/443 traffic, IPs labeled *vpn*, but not www.

20

slide-76
SLIDE 76

VPN traffic: Central European IXP

VPN identification

  • Port-based: Well known port/proto combinations exclusively used by

VPN services

  • DNS-based: For TCP/443 traffic, IPs labeled *vpn*, but not www.
  • 200% increase in domain-based VPN traffic in March during working

hours

20

slide-77
SLIDE 77

VPN traffic: Central European IXP

VPN identification

  • Port-based: Well known port/proto combinations exclusively used by

VPN services

  • DNS-based: For TCP/443 traffic, IPs labeled *vpn*, but not www.
  • 200% increase in domain-based VPN traffic in March during working

hours

  • Slight decrease in April

20

slide-78
SLIDE 78

VPN traffic: Central European IXP

VPN identification

  • Port-based: Well known port/proto combinations exclusively used by

VPN services

  • DNS-based: For TCP/443 traffic, IPs labeled *vpn*, but not www.
  • 200% increase in domain-based VPN traffic in March during working

hours

  • Slight decrease in April & June

20

slide-79
SLIDE 79

How did edu traffic change?

slide-80
SLIDE 80

Ingress-egress traffic ratio: REDIMadrid

Ingress vs. egress traffic ratio 5 10 15 20 Thu Fri Sat Sun Mon Tue Wed

  • base 2020−02−27 2020−03−04

transition 2020−03−12 2020−03−18

  • nline−lecturing 2020−04−16 2020−04−22

21

slide-81
SLIDE 81

Ingress-egress traffic ratio: REDIMadrid

Ingress vs. egress traffic ratio 5 10 15 20 Thu Fri Sat Sun Mon Tue Wed

  • base 2020−02−27 2020−03−04

transition 2020−03−12 2020−03−18

  • nline−lecturing 2020−04−16 2020−04−22
  • Large decrease in traffic and number of connections

21

slide-82
SLIDE 82

Ingress-egress traffic ratio: REDIMadrid

Ingress vs. egress traffic ratio 5 10 15 20 Thu Fri Sat Sun Mon Tue Wed

  • base 2020−02−27 2020−03−04

transition 2020−03−12 2020−03−18

  • nline−lecturing 2020−04−16 2020−04−22
  • Large decrease in traffic and number of connections
  • Traffic ratio significantly decreased from 15:1 to 4:1

21

slide-83
SLIDE 83

Protocol changes: REDIMadrid

  • ●
  • ● ●
  • ●
  • ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ●
  • ● ● ● ● ●
  • ● ● ● ●
  • ●

Transition phase Easter

0.10 0.25 0.50 1.00 2.00 5.00 10.00 2 7 / 2 / 2 2 4 / 3 / 2 2 1 1 / 3 / 2 2 1 8 / 3 / 2 2 2 5 / 3 / 2 2 1 / 4 / 2 2 8 / 4 / 2 2 1 5 / 4 / 2 2

Date Relative daily growth (Log) Traffic class

  • Eyeball ISPs (Email, In)

Eyeball ISPs (VPN, In) Eyeball ISPs (Web, In) Hypergiants (Web, Out) Push notifications (Out) QUIC (Out)

22

slide-84
SLIDE 84

Protocol changes: REDIMadrid

  • ●
  • ● ●
  • ●
  • ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ●
  • ● ● ● ● ●
  • ● ● ● ●
  • ●

Transition phase Easter

0.10 0.25 0.50 1.00 2.00 5.00 10.00 2 7 / 2 / 2 2 4 / 3 / 2 2 1 1 / 3 / 2 2 1 8 / 3 / 2 2 2 5 / 3 / 2 2 1 / 4 / 2 2 8 / 4 / 2 2 1 5 / 4 / 2 2

Date Relative daily growth (Log) Traffic class

  • Eyeball ISPs (Email, In)

Eyeball ISPs (VPN, In) Eyeball ISPs (Web, In) Hypergiants (Web, Out) Push notifications (Out) QUIC (Out)

  • Large increase in incoming web (1.7x), email (1.8x), VPN (4.8x),

remote desktop (5.9x), and SSH (9.1x) traffic.

22

slide-85
SLIDE 85

Protocol changes: REDIMadrid

  • ●
  • ● ●
  • ●
  • ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ●
  • ● ● ● ● ●
  • ● ● ● ●
  • ●

Transition phase Easter

0.10 0.25 0.50 1.00 2.00 5.00 10.00 2 7 / 2 / 2 2 4 / 3 / 2 2 1 1 / 3 / 2 2 1 8 / 3 / 2 2 2 5 / 3 / 2 2 1 / 4 / 2 2 8 / 4 / 2 2 1 5 / 4 / 2 2

Date Relative daily growth (Log) Traffic class

  • Eyeball ISPs (Email, In)

Eyeball ISPs (VPN, In) Eyeball ISPs (Web, In) Hypergiants (Web, Out) Push notifications (Out) QUIC (Out)

  • Large increase in incoming web (1.7x), email (1.8x), VPN (4.8x),

remote desktop (5.9x), and SSH (9.1x) traffic.

  • Large decrease in outgoing web traffic (50%) and mobile traffic

(65% of push notifications’ traffic)

22

slide-86
SLIDE 86

What we found

slide-87
SLIDE 87

People change → traffic changes

  • Changes in people’s lives lead to new traffic patterns

23

slide-88
SLIDE 88

People change → traffic changes

  • Changes in people’s lives lead to new traffic patterns
  • Difference between workday and weekend vanishes

23

slide-89
SLIDE 89

People change → traffic changes

  • Changes in people’s lives lead to new traffic patterns
  • Difference between workday and weekend vanishes
  • Applications for remote work, education, VPN, and video

conferencing see significant increase in traffic

23

slide-90
SLIDE 90

People change → traffic changes

  • Changes in people’s lives lead to new traffic patterns
  • Difference between workday and weekend vanishes
  • Applications for remote work, education, VPN, and video

conferencing see significant increase in traffic

  • Absence of users can lead to decrease in traffic for certain

applications

23

slide-91
SLIDE 91

People change → traffic changes

  • Changes in people’s lives lead to new traffic patterns
  • Difference between workday and weekend vanishes
  • Applications for remote work, education, VPN, and video

conferencing see significant increase in traffic

  • Absence of users can lead to decrease in traffic for certain

applications

  • Many of the relevant applications are not served by hypergiants →

sole focus on hypergiants is not sufficient

23

slide-92
SLIDE 92

People change → traffic changes

  • Changes in people’s lives lead to new traffic patterns
  • Difference between workday and weekend vanishes
  • Applications for remote work, education, VPN, and video

conferencing see significant increase in traffic

  • Absence of users can lead to decrease in traffic for certain

applications

  • Many of the relevant applications are not served by hypergiants →

sole focus on hypergiants is not sufficient Our vantage points reveal that the impact of the COVID-19 panedmic is directly reflected in changes to Internet traffic patterns.

23

slide-93
SLIDE 93

Traffic changes → networks change

  • Traffic increase of 15-30% within a few days
  • Networks usually provision for ≈30% increase per year

24

slide-94
SLIDE 94

Traffic changes → networks change

  • Traffic increase of 15-30% within a few days
  • Networks usually provision for ≈30% increase per year
  • Impact on peak traffic is limited, but valleys get filled

24

slide-95
SLIDE 95

Traffic changes → networks change

  • Traffic increase of 15-30% within a few days
  • Networks usually provision for ≈30% increase per year
  • Impact on peak traffic is limited, but valleys get filled
  • The Central European IXP reports capacity increases of around

1,500 Gbps

24

slide-96
SLIDE 96

Traffic changes → networks change

  • Traffic increase of 15-30% within a few days
  • Networks usually provision for ≈30% increase per year
  • Impact on peak traffic is limited, but valleys get filled
  • The Central European IXP reports capacity increases of around

1,500 Gbps

  • Networks could react quickly to the additional need for capacity

24

slide-97
SLIDE 97

Traffic changes → networks change

  • Traffic increase of 15-30% within a few days
  • Networks usually provision for ≈30% increase per year
  • Impact on peak traffic is limited, but valleys get filled
  • The Central European IXP reports capacity increases of around

1,500 Gbps

  • Networks could react quickly to the additional need for capacity

Well-provisioned networks can accomodate sudden changes in demand if they’re planned with spare capacity and quick reaction times.

24

slide-98
SLIDE 98

Traffic changes → networks change

  • Traffic increase of 15-30% within a few days
  • Networks usually provision for ≈30% increase per year
  • Impact on peak traffic is limited, but valleys get filled
  • The Central European IXP reports capacity increases of around

1,500 Gbps

  • Networks could react quickly to the additional need for capacity

Well-provisioned networks can accomodate sudden changes in demand if they’re planned with spare capacity and quick reaction times.

Contact emails: narseo.vallina@imdea.org jestevez@inf.uc3m.es Paper link: arXiv:2008.10959

24