Tag Archives : Streaming media August 2009

The Internet After Dark (Part 2)

By: Craig Labovitz -

This blog completes our informal three week study of Internet daily traffic patterns. Using data from the Internet Observatory, we analyzed weekday application traffic across 110 geographically diverse ISPs, including some of the largest carriers in North American and Europe. We believe this report (and upcoming paper) represent the largest study of Internet traffic temporal characteristics to date.

In the first half of this post, we showed unlike European Internet traffic which peaks in the early evening and then drops off until the next day’s business hours, US Internet traffic reaches its peak at 11pm EDT and then stays relatively high until 3am in the morning.

The question is what are Internet users doing after dark?

The answer: long after Exchange and Oracle business traffic slows to a crawl, Internet users turn to the web to surf, watch videos, send IM’s and happily try to kill each other.

We illustrate these trends with graphs of four application categories below.


The top two graphs show the daily average traffic fluctuations of TCP / UDP ports related two popular online game multi-player platforms: World of Warcraft and Steam (which includes many popular first person shooter games like Half Life). The bottom two graphs show common video and instant messaging protocols. As in earlier analysis, we take the average of North American consumer / regional providers traffic over 10 weekdays in July. To make the graph more readable, we show traffic as a percentage of peak traffic levels. All times are EDT.

Some observations:

  • Gamers Come Out at Night: Unlike most Internet applications which peak midday or late afternoon, online game traffic grows by more than 60% after 2pm. Gaming prime time appears to be between 8pm and 11pm EDT weekday nights (corresponding to the traditional and now declining television prime time hours). By comparison, web traffic levels remain relatively constant through the late afternoon and peaks much earlier at 5pm.
  • A Guild that Plays Together Stays Together: Unlike other online game traffic, World of Warcraft’s Battlenet shows a distinct 30% jump exactly at 8pm EDT every evening. In-house WoW level 80 colleagues suggest 8pm is a common time for guilds to set out on quests. Also unlike other game traffic, WoW declines rapidly after 11pm every night. Again, we suspect WoW traffic patterns are related to the more large group, social nature of World of Warcraft.
  • Midnight Video: Of all Internet applications, streaming video protocols reach their traffic peak the latest around midnight EDT every evening. We do not have very good visibility into what Internet users are watching this late, but correlation with large content site traffic patterns (below) provides some clues.
  • Always in Touch: Beginning at 9am EDT at lasting though midnight, Internet users IM constantly. The IM graph above shows traffic reaches 80% of peak by 10am and stays above 80% until midnight (with a 5pm EDT peak — perhaps related to millions of users making dinner plans). Interestingly, email exhibits a very different pattern and plummets by more than 30% immediately after 5pm EDT.

As mentioned earlier, we do not have detailed visibility into what Internet users are watching at midnight but ASN level traffic analysis provides some hints. Predictably, traffic grows dramatically to consumer sites like Google’s YouTube and large CDN / video providers. Also not surprisingly, we see a large jump in traffic to colo / hosting companies with adult content such as a 40% jump to ISPrime (AS23393) between 10pm and 1am EDT. We will explore one of the fastest growing and largest nighttime sites, Carpathia Hosting (AS29748), in an upcoming blog.

Editor’s Note: This blog is the third in a series of weekly posts leading up to the publication of the joint University of Michigan, Merit Network and Arbor Networks “2009 Internet Observatory Report”. The full technical reports goes into detail on the evolving Internet topology, commercial ecosystem and traffic patterns — available this October. Next week: “Who Put the IPv6 in My Internet?”

Reblog this post [with Zemanta]

The Great Obama Traffic Flood

By: Craig Labovitz -

Streaming video traffic coverage of Obama’s inauguration flooded North American backbones today. Traffic increases varied wildly across US providers with some seeing an overall 5% increase in backbone traffic and others jumping more than 40%.

This multi terabit per second flood represents one of the single largest one day spikes in Internet traffic since ATLAS Internet Observatory monitoring began five years ago. Apparently, US presidents are more popular than pro golfers — the inauguration traffic handily beat the last Internet traffic record set during the US Open.

While most of the US infrastructure appears to have withstood the flood, at least two ISPs showed clear failures and traffic drops during the traffic peaks coincident with Obama’s swearing in (traffic levels started to drop quickly beginning with the subsequent poetry readings).

Chiefly the traffic surge centered on Flash (TCP port 1935) and UDP port 8247 (which includes CNN streaming). In the US, most of these increases focused on consumer (DSL / MSO) providers and transit ISPs (especially those interconnecting large CDNs). Flash traffic spiked by more than 60% in most providers and by 400% in a few of the larger cable operators.

The below graph shows both of these ports across 10 of the largest US ISPs participating in Arbor’s ATLAS Internet Observatory traffic sharing initiative (see NANOG presentation for more details).

Great Obama Traffic Flood

While US backbones saw a large inauguration traffic spike, Europeans and Asian viewers appeared less interested in US politics with an under 1% increase in backbone traffic (in fairness, timezone differences also likely had a significant impact). Our Canadian neighbors proved more interested with a 2-5% growth in backbone traffic today.

Though multiple content providers hosted the traffic streams today, Limelight (AS 22822) was one of the clear winners — ATLAS data across the ten US consumers ISPs show a massive increase in AS22822 traffic (median of 160%). Akamai showed a more modest increase of 17%.

The Obama inauguration marks a historic day in US politics and a remarkable day for the popularity of Internet streaming video. We look forward to watching more great things to come.

(Co-authored with Scott Iekel-Johnson)

Reblog this post [with Zemanta]