The Internet After Dark (Part 2)

This blog completes our informal three week study of Internet daily traffic patterns. Using data from the Internet Observatory, we analyzed weekday application traffic across 110 geographically diverse ISPs, including some of the largest carriers in North American and Europe. We believe this report (and upcoming paper) represent the largest study of Internet traffic temporal characteristics to date.

In the first half of this post, we showed unlike European Internet traffic which peaks in the early evening and then drops off until the next day’s business hours, US Internet traffic reaches its peak at 11pm EDT and then stays relatively high until 3am in the morning.

The question is what are Internet users doing after dark?

The answer: long after Exchange and Oracle business traffic slows to a crawl, Internet users turn to the web to surf, watch videos, send IM’s and happily try to kill each other.

We illustrate these trends with graphs of four application categories below.


The top two graphs show the daily average traffic fluctuations of TCP / UDP ports related two popular online game multi-player platforms: World of Warcraft and Steam (which includes many popular first person shooter games like Half Life). The bottom two graphs show common video and instant messaging protocols. As in earlier analysis, we take the average of North American consumer / regional providers traffic over 10 weekdays in July. To make the graph more readable, we show traffic as a percentage of peak traffic levels. All times are EDT.

Some observations:

  • Gamers Come Out at Night: Unlike most Internet applications which peak midday or late afternoon, online game traffic grows by more than 60% after 2pm. Gaming prime time appears to be between 8pm and 11pm EDT weekday nights (corresponding to the traditional and now declining television prime time hours). By comparison, web traffic levels remain relatively constant through the late afternoon and peaks much earlier at 5pm.
  • A Guild that Plays Together Stays Together: Unlike other online game traffic, World of Warcraft’s Battlenet shows a distinct 30% jump exactly at 8pm EDT every evening. In-house WoW level 80 colleagues suggest 8pm is a common time for guilds to set out on quests. Also unlike other game traffic, WoW declines rapidly after 11pm every night. Again, we suspect WoW traffic patterns are related to the more large group, social nature of World of Warcraft.
  • Midnight Video: Of all Internet applications, streaming video protocols reach their traffic peak the latest around midnight EDT every evening. We do not have very good visibility into what Internet users are watching this late, but correlation with large content site traffic patterns (below) provides some clues.
  • Always in Touch: Beginning at 9am EDT at lasting though midnight, Internet users IM constantly. The IM graph above shows traffic reaches 80% of peak by 10am and stays above 80% until midnight (with a 5pm EDT peak — perhaps related to millions of users making dinner plans). Interestingly, email exhibits a very different pattern and plummets by more than 30% immediately after 5pm EDT.

As mentioned earlier, we do not have detailed visibility into what Internet users are watching at midnight but ASN level traffic analysis provides some hints. Predictably, traffic grows dramatically to consumer sites like Google’s YouTube and large CDN / video providers. Also not surprisingly, we see a large jump in traffic to colo / hosting companies with adult content such as a 40% jump to ISPrime (AS23393) between 10pm and 1am EDT. We will explore one of the fastest growing and largest nighttime sites, Carpathia Hosting (AS29748), in an upcoming blog.

Editor’s Note: This blog is the third in a series of weekly posts leading up to the publication of the joint University of Michigan, Merit Network and Arbor Networks “2009 Internet Observatory Report”. The full technical reports goes into detail on the evolving Internet topology, commercial ecosystem and traffic patterns — available this October. Next week: “Who Put the IPv6 in My Internet?”

Reblog this post [with Zemanta]

22 Responses to “The Internet After Dark (Part 2)”

August 31, 2009 at 4:24 pm, Interesting Information Security Bits for 08/31/2009 | Infosec Ramblings said:

[…] is the second half of a post pointed to recently. Interesting stuff. >> The Internet After Dark (Part 2) * Security to the Core | Arbor Networks Security Tags: ( general […]

September 01, 2009 at 12:13 am, DarkKnightH20 said:

You guys have been on fire with your articles lately! I’m using an exert on if you don’t mind and linking articles 1 and 2 🙂 Excellent graphs.

September 01, 2009 at 6:28 am, John James said:

Interesting information, but you should try to make the graphs a little more consistent (i.e. make them have the same scale and begin at 0%).

September 01, 2009 at 8:55 am, Ordis said:

Of all Internet applications, streaming video protocols reach their traffic peak the latest around midnight EDT every evening.” HAHAHAHA

September 01, 2009 at 2:32 pm, Net Biz In Buzz » Internet Traffic Peaks and Drops said:

[…] “What are Internet users doing after dark?” – That’s the question Craig Labovitz of Arbor Networks asked as the European Internet traffic usages were examined by each hour. The peak time of their usage? 11pm.  Gamers are obviously active at the time, but so are midnight video watchers.  Internet After Dark […]

September 02, 2009 at 4:59 am, rudolf said:

Might part of the answer be that some of the multimedia online services are not available to Europeans? Hulu for instance isn’t available in Europe and for many countries I wouldn’t even know of an equivalent like iPlayer (BBC UK) or Uitzending Gemist (Public broadcasters NL). Furthermore in .NL I can only watch local content on Uitzending Gemist and no American content like Heroes, Madmen etc (On iPlayer you can). The Plusnet blog has some information on the kind of traffic patterns they see with iPlayer and Heroes is quite often mentioned there.

The same goes for the iTunes store. No movies and tv-series for me. Part of the blame lies with the laws in the EU that make it difficult to sell movies all over Europe. Another part of the blame lies in my opinion with the media industry who are so centered on The United States that all innovation in content delivery eventually takes place there. This despite the better broadband situation in most of Western Europe.

So let me put forward an idea that part of the reason why the US does more online after 10-11pm is because at that time the quality of TV goes down and the US switches to the internet to catch up on prime time content they missed. In Europe people switch to DVD boxes, crappy content and bed, as there is nothing on anymore.

September 03, 2009 at 8:20 am, What Keeps Us Online Late at Night: Porn, Games, and Chat | Casey-Computing and Technology said:

[…] [Image courtesy of Arbor Networks] […]

September 03, 2009 at 8:44 am, What keeps us online late at night? | Just Social! said:

[…] [Image courtesy of Arbor Networks] […]

September 03, 2009 at 10:17 am, What Keeps Us Online Late at Night: Porn, Games, and Chat said:

[…] a close analysis of some of the hosting providers with strong nighttime traffic.[Image courtesy of Arbor Networks]Tags: internet, online habitsShare this […]

September 03, 2009 at 10:39 am, What Keeps Us Online Late at Night: Porn, Games, and Chat  said:

[…] [Image courtesy of Arbor Networks] […]

September 03, 2009 at 5:38 pm, Check some more « Fisheye Interns said:

[…] the most video online being streamed? Well then take a look at The Internet After Dark: Part 1 and Part 2. Great depth in explanation and […]

September 04, 2009 at 4:24 am, Study: Night-time is prime-time online in the U.S « The Slice Ltd – Affiliate Network said:

[…] doing online late into the night? Watching videos, viewing pornography and gaming, found the study. Watching videos peaks at midnight (EDT) when, says the report, “Predictably, traffic grows […]

September 04, 2009 at 6:07 am, What Keeps Us Online Late at Night: Porn, Games, and Chat « Host Yard IT Services said:

[…] [Image courtesy of Arbor Networks] […]

September 04, 2009 at 5:04 pm, Chat, Pornografía y Juegos: Lo que mantiene Internet activo de Noche | Soxial Media said:

[…] sueño se redujeron y todos nos convertimos en noctámbulos empedernidos. Un estudio realizado por Arbor Networks nos revela la hora punta de Internet, que es mucho más tarde de lo que todos creíamos, así como […]

September 07, 2009 at 2:51 pm, Ordis said:

The same goes for the iTunes store

September 08, 2009 at 12:58 pm, Brett Watson said:

While I’m sure adult content is a large part of the video content, I have to wonder what impact services such as Amazon’s Unbox and the rise of Netflix instant streaming are having in that video graph. That would be an interesting study all by itself.

September 29, 2009 at 1:41 pm, What Keeps Us Online Late at Night: Porn, Games, and Chat | Twitter Nest said:

[…] [Image courtesy of Arbor Networks] […]

October 14, 2009 at 1:41 pm, Two-Year Study of Global Internet Traffic Will Be Presented At NANOG47 said:

[…] • Internet Observatory blog post series: /blog/asert/2009/08/what-europeans-do-at-night/ /blog/asert/2009/08/the-internet-after-dark/ /blog/asert/2009/08/the-internet-after-dark-part-ii/ […]

October 23, 2009 at 2:44 am, We All » Blog Archive » World of Warcraft in the ‘net’s traffic patterns said:

[…] Arbor Networks is a company that continually monitors the Internet and its usage — they keep track of Internet outages and site visits on a global scale. They just recently released a report of when traffic peaks in the evenings around the world, and at least one of their results is about the game we’re all playing, none other than World of Warcraft. In terms of just general consumer traffic online, the numbers tend to peak, according to the report, at around 8-11pm — the time right before bed when most Americans are done with dinner, and have a little free time to jump online and browse around. In terms of what they’re doing when online, simple web browsing makes up most of that traffic (52%), what’s the rest of it? Gaming, including WoW. […]

October 23, 2009 at 4:13 pm, Gamers come out at night « WoW – Journal von Nomadenseele said:

[…] The internet after dark (2) […]

June 23, 2010 at 8:56 am, James said:

Potentially the peak of streaming at midnight is due to the release time of ripped tv shows of the same date. It usually takes 3-5 hours to start seeing the latest episodes being published on streaming sites.

March 06, 2012 at 4:29 am, agencja ochrony said:

agencja ochrony…

[…]The Internet After Dark (Part 2) | DDoS and Security Reports | Arbor Networks Security Blog[…]…

Comments are closed.