Network traffic insights in the time of COVID-19

Posted by Nokia

Executive summary

Updates on previous findings:

• Immediately after lockdown, we have seen weekday peak traffic increases over 45% and in some cases even over 50%, and weekend evening peak traffic increases over 20%-40% over their pre-lockdown levels
• Over the last couple of weeks, we have seen flattening growth, where most networks in lockdown showed modest or no growth over the previous week
• However, most recent weekend peak traffic volumes are still at least 20%-30% over pre-pandemic values
• In Europe, flattening traffic curves are likely due to a combination of peak video consumption, reaching practical maximum levels and SVOD (e.g., Netflix, Google) QoE reductions
• Consistent video streaming rates indicate sufficient network capacity

New findings this week:

• Continuing growth in subscriber upstream traffic – above 30% on average
• Distributed Denial of Service (DDoS) traffic is up by over 40%

Upstream is on the upswing

Looking at the upstream traffic (select networks in the US) for the month of March 2020, we noticed a 30% increase in the upstream traffic over their pre-pandemic levels.

In some networks in Europe, we observed average, per-consumer upstream now peaking at 1.7 Mbps – up from 1.1 Mbps at the beginning of March, and staying at these levels for extended periods during the day.

This increase of upstream traffic is a probable outcome of the phenomenal growth in the use of videoconferencing and collaboration tools, which require higher bandwidth to the cloud. We have also seen an increase in Microsoft Office suite upstream traffic as almost everyone that can work from home is doing so.

Houses of paper won’t break the networks of steel

Weekends (especially the evenings) during lockdown continue to be the tests of whether networks can address the additional demand. As stated previously, the bulk of network traffic at these peak hours (Fri-Sun, 9 pm – 11 pm local) is streaming video on demand (or subscription video on demand, SVOD).

An interesting streaming video moment was recorded in Spain on Friday, April 4, when SVOD traffic eclipsed its Saturday and Sunday peak levels (which are typically higher).

On April 3, Netflix released the fourth season of the highly anticipated Spanish series “Money Heist” (in Spanish: La Casa de Papel), and the fans responded:

• The number of Netflix streams increased by 36% compared to the previous Friday
• Total (daily) peak traffic increased by 47% (comparing Friday, April 4 to Friday, March 27)

Interestingly, we also noticed that the quality of Netflix streams (average bit rate, or streaming speed) increased by 11%. A positive sign but still below the speeds before Netflix’s voluntary reduction in streaming speeds, which started on March 20.

A resurgence of web browsing

Another interesting finding is that during both weekdays and weekends, right after video applications (SVOD and videoconferencing), which are combined on the diagram below, web browsing rose to be #2 traffic-contributing application – much higher in volume than gaming, social networking, and peer-to-peer (p2p).

Weekend traffic: A global look at March 2020

We took a look at weekend traffic during the whole month of March – for a select number of networks in Europe, the US, and Latin America.

Leaving aside the outliers (some networks which experienced growth over 60% from their typical, pre-pandemic values), the networks in Europe largely stabilized with regard to their weekend peak traffic increases but are still well above their pre-pandemic levels.

Looking at the select number of networks in the US, it seems that the largest networks experienced the most substantial growth and, in some of them, the growth of the weekend peak traffic continues, exceeding the pre-pandemic levels anywhere between 20% and 30%+.

In Latin American networks, we saw some steep declines in the demand toward the end of the month, but generally, weekend peak traffic has grown over 20% in all the networks we observed. Here, like in the US, the largest networks experienced the most substantial increase in weekend peak traffic.

Keeping an eye on security

This week we are also reporting on Distributed Denial of Service (DDoS) traffic – from early February to the beginning of April. Over that period, we looked at aggregate daily volumes (in terabytes) for five large service providers.

Distributed denial-of-service traffic is a malicious traffic aimed at rendering websites or online services inoperable. DDoS uses many different techniques for achieving this goal, but the end result is the same – the network infrastructure and online services are seriously affected – slowed down or out of service, and the users left without access to internet services, applications or content.

Clearly the stakes now are even higher when considering the potential consequences of these attacks. In normal circumstances they are a threat to a business’ livelihood and reputation. In situation when broadband connectivity is an essential service, protecting network infrastructure and services becomes critical, if not vital.

We noticed a steady increase in the overall volume of DDoS traffic – with amounts exceeding the pre-pandemic levels by 40%. This increase may be related to the significant rise in gaming-related DDoS attacks; we continue to investigate this issue – so more to come on this topic.

Closing thoughts

Peak traffic continues to increase in all regions, mainly as a result of streaming video and videoconferencing traffic, but the increases are slowing.

Networks seem to be handling these increases well.

We will continue to monitor the global and local effects of the COVID-19 pandemic on networks worldwide and will be providing longer-view updates.

As mentioned previously, the basis for all our analyses is the information we obtain from the Nokia Deepfield portfolio of network insight, analytics and DDoS security products.

―CT Bureau