Skip to main content

Network traffic insights in the time of COVID-19: April 9 update

alt

We follow up on our previous blogs (March 20 and March 27, which were captured in a report, and April 2) with a summary of the past 4+ weeks.

Executive summary

  • Updates on previous findings:
    • Immediately after lockdown, we have seen weekday peak traffic increases over 45% and in some cases even over 50%, and weekend evening peak traffic increases over 20%-40% over their pre-lockdown levels
    • Over the last couple of weeks, we have seen flattening growth, where most networks in lockdown showed modest or no growth over the previous week
    • However, most recent weekend peak traffic volumes are still at least 20%-30% over pre-pandemic values
    • In Europe, flattening traffic curves are likely due to a combination of peak video consumption, reaching practical maximum levels and SVOD (e.g., Netflix, Google) QoE reductions
    • Consistent video streaming rates indicate sufficient network capacity
  • New findings this week:
    • Continuing growth in subscriber upstream traffic – above 30% on average
    • Distributed Denial of Service (DDoS) traffic is up by over 40%

Upstream is on the upswing

Looking at the upstream traffic (select networks in the US) for the month of March 2020, we noticed a 30% increase in the upstream traffic over their pre-pandemic levels. 

In some networks in Europe, we observed average, per-consumer upstream now peaking at 1.7 Mbps – up from 1.1 Mbps at the beginning of March, and staying at these levels for extended periods during the day.

This increase of upstream traffic is a probable outcome of the phenomenal growth in the use of videoconferencing and collaboration tools, which require higher bandwidth to the cloud. We have also seen an increase in Microsoft Office suite upstream traffic as almost everyone that can work from home is doing so.

Houses of paper won’t break the networks of steel

Weekends (especially the evenings) during lockdown continue to be the tests of whether networks can address the additional demand. As stated previously, the bulk of network traffic at these peak hours (Fri-Sun, 9 pm – 11 pm local) is streaming video on demand (or subscription video on demand, SVOD).

An interesting streaming video moment was recorded in Spain on Friday, April 4, when SVOD traffic eclipsed its Saturday and Sunday peak levels (which are typically higher). 

Streaming video in Spain

On April 3, Netflix released the fourth season of the highly anticipated Spanish series “Money Heist” (in Spanish: La Casa de Papel), and the fans responded:

  • The number of Netflix streams increased by 36% compared to the previous Friday
  • Total (daily) peak traffic increased by 47% (comparing Friday, April 4 to Friday, March 27)

Interestingly, we also noticed that the quality of Netflix streams (average bit rate, or streaming speed) increased by 11%. A positive sign but still below the speeds before Netflix’s voluntary reduction in streaming speeds, which started on March 20.

A resurgence of web browsing

Another interesting finding is that during both weekdays and weekends, right after video applications (SVOD and videoconferencing), which are combined on the diagram below, web browsing rose to be #2 traffic-contributing application – much higher in volume than gaming, social networking, and peer-to-peer (p2p).

Traffic in Europe

Weekend traffic: A global look at March 2020

We took a look at weekend traffic during the whole month of March – for a select number of networks in Europe, the US, and Latin America.

Leaving aside the outliers (some networks which experienced growth over 60% from their typical, pre-pandemic values), the networks in Europe largely stabilized with regard to their weekend peak traffic increases but are still well above their pre-pandemic levels.

Sunday graph of traffic for Europe

Looking at the select number of networks in the US, it seems that the largest networks experienced the most substantial growth and, in some of them, the growth of the weekend peak traffic continues, exceeding the pre-pandemic levels anywhere between 20% and 30%+.

Sunday US graph

In Latin American networks, we saw some steep declines in the demand toward the end of the month, but generally, weekend peak traffic has grown over 20% in all the networks we observed. Here, like in the US, the largest networks experienced the most substantial increase in weekend peak traffic.

Sunday Latin America graph

Keeping an eye on security

This week we are also reporting on Distributed Denial of Service (DDoS) traffic – from early February to the beginning of April. Over that period, we looked at aggregate daily volumes (in terabytes) for five large service providers.

Distributed denial-of-service traffic is a malicious traffic aimed at rendering websites or online services inoperable. DDoS uses many different techniques for achieving this goal, but the end result is the same – the network infrastructure and online services are seriously affected – slowed down or out of service, and the users left without access to internet services, applications or content.

Clearly the stakes now are even higher when considering the potential consequences of these attacks. In normal circumstances they are a threat to a business’ livelihood and reputation. In situation when broadband connectivity is an essential service, protecting network infrastructure and services becomes critical, if not vital.

We noticed a steady increase in the overall volume of DDoS traffic – with amounts exceeding the pre-pandemic levels by 40%. This increase may be related to the significant rise in gaming-related DDoS attacks; we continue to investigate this issue - so more to come on this topic.

DDoS traffic

Closing thoughts

Peak traffic continues to increase in all regions, mainly as a result of streaming video and videoconferencing traffic, but the increases are slowing.

Networks seem to be handling these increases well.

We will continue to monitor the global and local effects of the COVID-19 pandemic on networks worldwide and will be providing longer-view updates.

As mentioned previously, the basis for all our analyses is the information we obtain from the Nokia Deepfield portfolio of network insight, analytics and DDoS security products.

Share your thoughts on this topic by joining the Twitter discussion with @nokia or @nokianetworks using #COVID19 #connectivity

Craig Labovitz

About Craig Labovitz

Craig (Dr. Craig Labovitz) co-founded Deepfield in 2011, which was acquired by Nokia in January 2017, and became a part of Nokia’s IP and Optical Networks. Currently, Dr. Labovitz has a role of Chief Technology Officer for Nokia Deepfield portfolio of Network Intelligence, Analytics and DDoS Security products.

Tweet us at @nokianetworks

Article tags