Under Attack? Call (844) END.DDoS

The Internet After Dark (Part 1)

After dark when the dinner dishes are put away and the kids are safely tucked into bed, the Internet subtly changes. Starting in the twilight of early evening, business traffic slows to a crawl, previously dormant applications flicker on home computer screens, and like clockwork, Internet activity begins its nightly climb towards a regular after hours bandwidth peak.

But before we get too carried away with metaphor and innuendo, some background.

In our last post blog post, we found (somewhat unexpectedly) that the pattern of North American daily Internet traffic differs from Europe and Asia. Unlike European Internet traffic which peaks around 7pm GMT and then quickly drops off until morning business hours, US Internet traffic reaches its peak at 11pm EDT and then stays relatively high until 3am in the morning (i.e. stays above 60% of peak or more).

This uniquely American traffic pattern holds true across dozens of individual ISPs, tens of millions of subscribers, and petabytes of daily Internet traffic.

The question is what are Americans doing at night?

To begin answering this question, we first recap Internet Observatory data from our earlier post. The below graph shows the daily average traffic fluctuations of 40 North American consumer / regional providers (taking the average of 10 weekdays in July). To make the graph more readable, we show traffic as a percentage of peak traffic levels. All times are EDT.

The way to interpret the graph above is that at 6am EDT North American traffic volumes are at 50% of their daily peaks. Traffic then climbs to a local maxima at 4pm and then a daily peak around 11pm EDT before again dropping during the early morning hours.

To understand the two North American traffic peaks at 4pm and 11pm graphed above, it helps to look only at consumer Internet traffic (i.e. as opposed to enterprise and tier1 transit). Below we overlay in yellow the average daily traffic from only US and Canadian consumer providers (i.e. only showing cable / DSL and excluding tier2, research, content, tier1, etc.).

From the graph its pretty clear consumer traffic plays a large role in the midnight North American traffic peak. We also see consumer traffic tends to climb later in the day (i.e. consumer traffic crosses 50% threshold after 9am as opposed to the broader Internet average of 6am) and consumer traffic trends towards filling the bulk of after-hours traffic. Perhaps most telling is the change in slope of graphed average consumer traffic around 6pm and then again around 8-9pm — all likely related to Americans turning to the Internet after dinner and during evening leisure hours.

But though we now know it is consumers driving the late night Internet traffic peak, we still have not answered what they are doing.

In response to our last post on the somewhat mysterious differences between American and European traffic patterns, readers offered a range of theories including:

  • More so than Europe, American traffic grows with web surfing and at night
  • Larges surges of P2P would explain North American traffic spikes
  • Americans watch more video and related adult entertainment late at night
  • In general, Europeans use the Internet less at night, have better social interactions, eat better food and generally live better lives

We finish this blog post by exploring which of the above theories do not account for the large midnight spike in North American traffic. I have no way to evaluate the last bullet point around higher European quality of life (although I’m pretty sure my high school French teacher is still insisting this is true).


During both the day and night the single largest Internet application is the web (52% of all Internet traffic on average).

But while web surfing plays a large role in North American traffic trends, the graph below shows web does not provide the complete explanation behind the American bandwidth peaks.

The “Daily Web Traffic” graph shows web as an average daily percentage of all North American Internet traffic. For purposes of this blog post, we define “web” as traffic on port 80, 8080 and 443. We note that web traffic includes both html page downloads as well as video and other applications running over HTTP.

From a daily low of 42%, web traffic grows by 10% at night to account for 52% of all Internet traffic. So web accounts for slightly over half of the late night traffic, but what is consuming the other half of American traffic?


Given all the press and provider angst over P2P traffic, many commenters suggested (incorrectly) that P2P is the source of the post midnight bulge in American Internet traffic. As a category, P2P is the second largest source of American Internet traffic coming in at roughly 15-20% of all North American traffic.

[Note: We’ll devote an article on the evolution of P2P traffic in an upcoming post. And, of course, the upcoming “2009 Internet Observatory” report goes into far more detail on the statistics and methodology than our more casual blog postings.]

Since most P2P does not use standard ports and/or includes encryption, we extrapolate the data below using a combination of Observatory port data with statistics from application payload characterization across several large US and Canadian cable operators. We again graph P2P as an average daily percentage of all North American Internet traffic.

Unlike the web and almost all other applications, the daily average P2P cycle does not coincide with broader traffic trends. In fact, the P2P daily trend is pretty much completely inverted from daily traffic. In other words, P2P reaches it low at 4pm when web and overall Internet traffic approaches its peak. P2P traffic only bursts from a low of 8% to a high of 17% of Internet traffic after midnight and then drops off at 6am.

As a side note, the cyclical inverted traffic pattern of P2P is interesting in its own accord. The inversion is highly suggestive of either persistent congestion or, more likely, evidence of widespread provider manipulation of P2P traffic rates.

So P2P also does not explain the midnight spike of American Internet traffic. What does? Next week we’ll complete this blog post in Part II and explore the applications behind North American traffic after dark.


September 2, 2009 Update:

Given some of the comments / questions around P2P as a percentage of Internet traffic versus a percentage of peak, a new graph below:


Looking at P2P as a percentage of P2P peak traffic shows even more clearly the inverted pattern (i.e. since Internet traffic begins to climb at 6am, the earlier graph previously obscured the even more pronounced 6am peak in relative P2P traffic levels).


Editor’s Note: This blog is the second in a series of weekly (or possibly semimonthly) posts leading up to the publication of the joint University of Michigan, Merit Network and Arbor Networks “2009 Internet Observatory Report”. The full technical reports goes into detail on the evolving Internet topology, commercial ecosystem and traffic patterns — available this October. Next week: “The Internet After Dark (Part II)”


Comments (41)

  • Avatar



    For me, 3AM in the eastern US is “chat with friends in Australia on IRC” time.

  • Geek Montage » “The Internet After Dark”


    […] read an interesting article on ArborNetworks a bit ago called The Internet After Dark (Part 1, Part 2). Both parts have graphical compilations of activity occuring throughout night and […]

  • Avatar




    Just a question:

    What is P2P for you ?

    It’s Napster, Kazaa or Grokster or Edonkey in this study ?
    so, i’s allright to see such things in this study !

    From my own idea, the users of the p2p is moving away with the arrival of the new P2P program like:
    Stealthnet, Oneswarm or Kommute.
    But, the study can’t analyze this, beacause it’s encrypted and anonymised.

    “The P2P is dead” you say, I say “long life to the P2P” !

    Sorry, I’m French, My english is … bad.

    Au revoir !

  • Avatar



    If other P2P users are like me and some of my friends, I have an explanation. If I’m web surfing, watching video, or using VOIP, then i turn off completely or throttle my own P2P upload bandwidth to 10% of my normal upload. Using P2P when i want to do something greatly hurts my performance, so I shut it off when I want maximum performance from my line. Then when i go to bed, or leave the house( go to work) i turn my P2P back on.

    I suppose if you did a widespread survey you could find out if other users are like me.

  • Avatar



    Interesting data, but I agree with KraftonZ that to be complete, the study will need to find a way to address encrypted P2P traffic.

    I also wonder about the objective measures for the following statement paraphrased from above:

    Europeans “generally live better lives” than Americans.

    Tell me, what data did you use to determine the quality of the average American life versus the quality of the average European life? When you say “American” do you mean just the U.S.? Or, do you include Mexico and Canada? Does your definition of “American” extend to the Caribbean or South America?

  • Contentinople - Ryan Lawler - News Bits: eBay Unloads Most of Skype


    […] Inc. chief scientist Craig Labovitz. In a blog post, Labovitz notes that P2P traffic has fallen to less than 20 percent of all U.S. Internet traffic in a recent study. But the interesting thing is when P2P traffic is at its strongest. Labovitz […]

  • Avatar

    Michael Leuchtenburg


    The inverted cyclic behavior of P2P, when measured proportionally as you have done here, indicates that P2P traffic is *constant*. The other traffic reduces, while P2P stays the same, thus becoming a higher proportion of overall traffic.

    P2P reaches a minimum at about 4pm – when overall traffic is at about 97% it’s about 8-9% of that traffic. P2P is at maximum at around 5am – when overall traffic is at 50%, it’s about 16% of that traffic. 16% of 0.5 is about the same is 8% of 0.97, thus P2P traffic is roughly constant according to your data.

  • Avatar



    The evening peak is everyone raiding in WoW untill all hours of the morning.

  • Avatar

    Father Xmas


    I don’t see mention of the three hour time zone spread from east coast to west coast. 8-11pm on the west coast translates to 11pm-2am on the east and since the time on the chart is east coast time, I don’t see the mystery.

  • Avatar

    Craig Labovitz


    Some general responses / comments:

    – The inline / portspan portion of our data includes payload derived statistics covering most known P2P protocols, including encrypted.

    – In response to private email and Michael’s comment above about P2P really being constant, I updated the post to include graphs both of P2P as a percentage of all Internet traffic and as a percentage of P2P peak traffic level. Though per the Digital Society article link above, this factual data may just add more fuel to the conspiracy…

    – My reference to reader suggestions of Europeans leading better lives was mostly in jest.

  • Avatar

    George Ou


    OK Craig, the data helps clear things up a little bit. The problem is that you can’t attribute this to “manipulation” because it’s more likely that people simply throttle their own P2P usage. I know that’s what I do because I can’t even make a VoIP call or Game while P2P is on, and I know this is what other people do.

    Moreover, the bulk of P2P is used by a minority of customers who can circumvent TCP’s Jacobson’s congestion control algorithm. This is where running 100 TCP flows gives you 100 times the resilience against the effects of Jacobson’s algorithm. http://blogs.zdnet.com/Ou/?p=1078. So it is possible that carriers are trying to counter this effect to make networks more fair. Comcast for example changed their network management system (post TCP reset) to de-prioritize the heaviest users behind the light users, and this will undoubtedly affect P2P consumption during the day and it’s justifiable. If we made it so that P2P traffic reflected its user population, P2P usage would probably be even lower than it is today and that would be fair. My big problem with your analysis is you characterization that this is “manipulation” which has inappropriate connotations.

    As for the total drop in P2P traffic, that’s understandable because people prefer on-demand web streaming using the CDN distribution model. People prefer to watch AS they download rather than watch AFTER they download. This is why Joost gave up using P2P for their video streaming solution.

  • Avatar

    Jay Frederick


    The only content/traffic type that can drive bandwidth numbers is video. Check ports 554/8554 (RTSP) used by QuickTime, Real, Windows Media Server, etc. and sites such as Hulu. Probably some other streaming media protocols & ports worth considering too.

    Maybe gamers like Mike and his WoW buddies make a dent, but sorry, that’s still a niche audience and in any event, Blizzard et. al. have done a lot to minimize the bandwidth required for those games.

  • Avatar



    The data is incomplete on this. 10 weekdays in july. The kids are out of school in july so they are up all night(i would know). More data needs to be collected.

  • ארה”ב: שעות הלילה הן הפריים טיים החדש באינטרנט; שעת השיא - 23:00 « אינטרנט, מדיה, טכנולוגיה | 140


    […] בארה"ב נרשם בשעה 23:00 בלילה (שעון החוף המזרחי) – כך עולה ממחקר חדש של חברת Arbor Networks שנערך במהלך יולי. מדובר בשינוי לעומת […]

  • Fisheye Interns


    […] and when is the most video online being streamed? Well then take a look at The Internet After Dark: Part 1 and Part 2. Great depth in explanation and […]

  • Avatar



    i would think the spike would be a lot more people being able to lay in bed with lap tops now when they are unable to sleep… you dont have to sit in the uncomfortable chairs at a desk anymore.

  • What Software Do You Use Most Often? | Oracle


    […] we’re thinking about behavior, I did find a study (Part 1, Part 2) by Arbor Networks (h/t Ars and Mashable) of online behavior interesting. So, I might as […]

  • Could Swine Flu Take the Internet Down? | Finley & Cook, PLLC


    […] of daily Internet traffic show that there are two periods of time when people access the network: during the workday (9 a.m. to 4 p.m.) and immediately […]

  • Two-Year Study of Global Internet Traffic Will Be Presented At NANOG47


    […] Observatory blog post series: /blog/asert/2009/08/what-europeans-do-at-night/ /blog/asert/2009/08/the-internet-after-dark/ […]

  • World of Warcraft in the ‘net’s traffic patterns - MR PC EASY


    […] they keep track of Internet outages and site visits on a global scale. They just recently released a report of when traffic peaks in the evenings around the world, and at least one of their results is about the game we’re all playing, none other than World […]

  • World of Warcraft in the ‘net’s traffic patterns | The Frozen Gnome


    […] they keep track of Internet outages and site visits on a global scale. They just recently released a report of when traffic peaks in the evenings around the world, and at least one of their results is about the game we’re all playing, none other than World […]

  • We All WoW.com » Blog Archive » World of Warcraft in the ‘net’s traffic patterns


    […] they keep track of Internet outages and site visits on a global scale. They just recently released a report of when traffic peaks in the evenings around the world, and at least one of their results is about the game we’re all playing, none other than World […]

  • World of Warcraft in the ‘net’s traffic patterns | zacsgames.com


    […] they keep track of Internet outages and site visits on a global scale. They just recently released a report of when traffic peaks in the evenings around the world, and at least one of their results is about the game we’re all playing, none other than World […]

  • Avatar

    Led Downlights


    Im in australia and our ISPs have peak and offpeak bandwidth allowances so most people with large downloads schedule them for offpeak, things like windows updates too take place after hours.

Comments are closed