Source-linked AI summary
The Lockdown Effect: Implications of the COVID-19 Pandemic on Internet Traffic
Anja Feldmann, Oliver Gasser, Franziska Lichtblau, Enric Pujol, Ingmar Poese, Christoph Dietzel, Daniel Wagner, Matthias Wichtlhuber, Juan Tapiador, Narseo Vallina-Rodriguez, Oliver Hohlfeld, Georgios Smaragdakis
TL;DR
The paper asks how government-mandated COVID-19 lockdowns changed Internet traffic as people shifted work, education, and social activity into residential connectivity. It analyzes flow data from an ISP, three IXPs, and an educational network, finding rapid traffic growth and major changes in timing, applications, and network-specific demand while infrastructure generally handled the new load.
Problem
Lockdowns shifted work, education, social activities, and entertainment onto residential Internet connectivity, raising the question of how these changes affected Internet traffic across networks.
Method
The study analyzes network flow data from a Central European ISP, three IXPs in Europe and the US, and a Spanish educational network.
Results
15-20% traffic increases appeared at the height of lockdown for the ISP and IXPs, while educational networks saw overall decreases alongside increases in remote-working and lecturing applications.
Takeaways & Limitations
Most traffic increases occurred outside traditional peak hours, and the Internet infrastructure handled the new volume despite substantial shifts in traffic patterns and composition.
Takeaways & Limitations
The educational-network analysis lacks historical summer traffic captures, limiting quantification of confinement effects on academic traffic.
Abstract
from arXiv · showhide
Due to the COVID-19 pandemic, many governments imposed lock downs that forced hundreds of millions of citizens to stay at home. The implementation of confinement measures increased Internet traffic demands of residential users, in particular, for remote working, entertainment, commerce, and education, which, as a result, caused traffic shifts in the Internet core. In this paper, using data from a diverse set of vantage points (one ISP, three IXPs, and one metropolitan educational network), we examine the effect of these lockdowns on traffic shifts. We find that the traffic volume increased by 15-20% almost within a week--while overall still modest, this constitutes a large increase within this short time period. However, despite this surge, we observe that the Internet infrastructure is able to handle the new volume, as most traffic shifts occur outside of traditional peak hours. When looking directly at the traffic sources, it turns out that, while hypergiants still contribute a significant fraction of traffic, we see (1) a higher increase in traffic of non-hypergiants, and (2) traffic increases in applications that people use when at home, such as Web conferencing, VPN, and gaming. While many networks see increased traffic demands, in particular, those providing services to residential users, academic networks experience major overall decreases. Yet, in these networks, we can observe substantial increases when considering applications associated to remote working and lecturing.
1 INTRODUCTION
The paper examines how COVID-19 lockdowns changed Internet traffic and user activity patterns across diverse vantage points. It motivates a multi-network analysis of increased residential demand, altered daily rhythms, application shifts, and contrasting effects on academic networks.
- COVID-19 lockdowns made residential Internet connectivity central to work, education, social activities, and entertainment for a large fraction of the population.
- Almost all days were classified as weekend-like after confinement measures were implemented, reflecting a drastic shift in daily traffic patterns.
- The study combines network data from a Central European ISP, three geographically distributed IXPs, and a Spanish educational network to examine effects at the Internet edge and core.
- 15-20% increases occurred at the height of lockdown for the ISP and IXPs, while the EDU network experienced decreases of up to 55%.
- Most traffic increases occurred during non-traditional peak hours, with daily traffic patterns moving toward weekend-like behavior.
- Remote-working applications such as VPN and conferencing tools increased their relative traffic share by more than 200%, while some education, social-media, and CDN traffic shares decreased.
2 DATASETS
The datasets combine flow records from Internet edge, backbone, peering, and academic vantage points, normalized and analyzed across continuous and selected weekly time frames. Privacy protections restrict the data to aggregated flow statistics without payload information.
- The study uses vantage points at Internet exchanges, an ISP’s backbone and peering points, and a metropolitan university network.
- ISP-CE data covers a large Central European ISP serving more than 15 million fixed-line subscribers and operating a Tier-1 transit network.
- The analysis uses NetFlow records from ISP border network gateways and border routers to study subscriber demand and companies operating their own ASNs.
- Data are normalized because the sources have substantially different traffic characteristics and volumes.
- NetFlow and IPFIX provide flow summaries from packet headers but no payload information; analyses are performed locally, with hashed IP addresses and aggregated outputs.
3 AGGREGATED TRAFFIC SHIFTS
Lockdowns produced substantial but uneven traffic shifts across the ISP and IXPs, with earlier daytime activity and weekend-like patterns. Non-hypergiant ASes and residentially connected services experienced especially pronounced changes, while link-utilization shifts were moderated by capacity upgrades and PNI changes.
- Overall traffic shifts: More than 20% overall traffic growth occurred at ISP-CE, alongside 30% at IXP-SE, 12% at IXP-CE, and 2% at IXP-US after lockdowns.Growth declined after restrictions relaxed at ISP-CE but persisted at IXP-CE and IXP-SE; IXP-US growth continued with its later lockdown.
- Temporal patterns: Traffic shifted toward earlier daytime activity and weekend-like patterns, including a small lunchtime dip and sustained late-evening spikes.The shift became less pronounced after lockdown measures were relaxed, with Easter and seasonal outdoor-activity effects noted for comparison weeks.
- Traffic sources: Other ASes grew more than hypergiants during workday working hours, exceeding 60% growth versus 40% for hypergiants.The difference diminished around mid-May, although both groups remained substantially above pre-lockdown levels.
- Link utilization: IXP link utilization shifted slightly downward during lockdown, consistent with capacity upgrades or members switching to private interconnection.Such changes can conceal increased usage for individual networks, but many non-hypergiant ASes still showed lockdown-related link-usage changes.
- Remote-work relevant ASes: Traffic increases involving residential eyeball networks correlated with total AS traffic increases for most ASes.Some ASes instead had declining total traffic while residential traffic grew, indicating heterogeneous effects across services.
- Remote-work relevant ASes: Remote-working companies and enterprise subscribers were expected to appear among ASes with workday-dominated traffic ratios.The classification also included a small number of content-heavy ASes.
4 TRANSPORT-LAYER ANALYSIS
The transport-layer analysis compares hourly traffic changes across February, March, April, and June at the IXP-CE and ISP-CE. It finds substantial lockdown-related shifts in streaming, VPN, conferencing, and work-related traffic, with different distributions across the two vantage points.
- Measurement and presentation: The analysis omits TCP/80 and TCP/443 from Figures 7 and 8 because they comprise 60% and 80% of traffic at the IXP-CE and ISP-CE, respectively.The figures instead focus on the top 3–12 transport ports.
- Overall traffic shifts: Traffic volumes at the IXP-CE and ISP-CE changed substantially after lockdown, with patterns differing between the two networks.The datasets represent different customer populations, so similar top ports exhibit different distributions and temporal changes.
- Specific transport ports: QUIC traffic increased 30%–80% at the ISP-CE and about 50% at the IXP-CE in March versus February.The ISP-CE increase was largest in morning hours, while the IXP-CE increase was more distributed across the day.
- Specific transport ports: VPN-related UDP/4500 and UDP/1194 traffic increased during working hours at both vantage points in March.UDP/4500 remained above February levels in April and June, while OpenVPN traffic receded.
- Specific transport ports: Zoom UDP/8801 traffic at the ISP-CE increased by an order of magnitude from February to April.The increase is associated with companies deploying on-premises connectors during lockdown; traffic decreased again in June.
5 APPLICATION CLASSES
The application-class analysis classifies traffic using transport ports and source/sink criteria, then compares eight end-user application classes across multiple vantage points. It finds strong growth in conferencing and gaming, changing social-media patterns, and differing CDN and VoD trends across locations.
- Method: Traffic is classified using more than 50 combinations of transport ports and autonomous-system source/sink criteria.The filtered traffic is aggregated into eight meaningful application classes.
- Entertainment-related applications: Gaming traffic at the IXP-SE showed a steep increase in both distinct source IPs and traffic volume during lockdown.These metrics approximate household participation and usage intensity.
- Communication-related applications: Web conferencing traffic increased by more than 200% during business hours at all analyzed vantage points.The increase also appeared on weekends at the ISP-CE, IXP-SE, and IXP-US.
- Social media: Social-media traffic increased strongly at first, then flattened as lockdown restrictions were gradually relaxed.At the ISP-CE, March traffic grew by 70%, with slower growth in April.
- Content delivery: CDN traffic increased in Europe but changed little or decreased at the IXP-US.The paper notes that the US result may reflect traffic engineering by a large CDN provider.
- Cross-application findings: Communication applications increased during working hours, while gaming and VoD were consumed throughout the day and became more demanded during lockdown.The results link these shifts to changed human activity patterns during the pandemic.
6 VPN TRAFFIC SHIFT
The VPN analysis addresses the difficulty of identifying VPN traffic from transport ports alone. Using both port-based and domain-based identification, it finds a pronounced work-hour increase during lockdown and argues that domain data provides a more accurate view.
- VPN traffic changes: Domain-based VPN traffic increased by more than 200% during workday working hours in March compared with the February base week.The weekend increase was less pronounced than the workday increase.
- Identification methods: Port-based analysis showed almost no change, whereas domain-based identification revealed significant VPN growth.The visible increase was concentrated in TCP/443 flows associated with vpn domains.
- Identification methods: The paper concludes that identifying VPN traffic solely by transport ports vastly undercounts actual VPN traffic.It proposes using domain data to classify seemingly HTTPS flows as VPN traffic.
7 EDUCATIONAL NETWORK
The educational network experienced sharply lower weekday traffic after lockdown, while remote-working and lecturing applications increased substantially. Traffic patterns also became more weekend-like, with incoming connections rising as users accessed university-hosted services from outside campus.
- Traffic volume: 55% maximum weekday traffic decrease accompanied the lockdown, while Saturday and Sunday traffic increased by 14% and 4%, respectively.The comparison uses a pre-lockdown baseline week and two post-lockdown weeks.
- Traffic volume: 24% median growth in total daily connections followed the state of emergency, despite reduced differences between workdays and weekends.Incoming connections doubled, while outgoing connections decreased almost by half.
- Remote applications: 77%+ median growth in daily incoming web connections coincided with outgoing connections falling by more than half after the transition phase.Outgoing connections to mobile services decreased by 65% on average, while Spotify connections decreased by 83%.
- Remote applications: 1.7x, 1.8x, 4.8x, 5.9x, and 9.1x median incoming connection growth occurred for web, email, VPN, Remote Desktop, and SSH, respectively.These classes were selected because they are associated with remote working and lecturing.
- Interpretation: Educational-network traffic changes were antagonistic yet complementary to those observed in residential ISPs.Users left campuses but continued accessing university services and conducting academic activities remotely.
8 RELATED WORK
Related work situates the study among early analyses of COVID-19’s Internet effects and earlier measurements of Internet behavior during disruptive events. The cited studies include work on remote learning and Internet resilience.
- Prior measurement studies: Prior research measured Internet behavior during major disruptive events, including routing and protocol changes during and after 9/11.Partridge et al. used measurements to study Internet resilience under stress.
- COVID-19 studies: Early COVID-19 research included analysis of remote learning activity by 16k students on the Politecnico di Torino campus network.The paper notes that published research was limited by the time of submission.
- COVID-19 studies: COVID-19 Internet-impact work initially appeared substantially in blog posts and network-operator conference presentations.The paper distinguishes these sources from the limited number of research studies available at submission.
9 DISCUSSION
The discussion argues that Internet traffic changed substantially during the pandemic while the observed infrastructure handled the rapid demand shift. Cloud services, operational practices, and rapid capacity additions are identified as contributing factors.
- Infrastructure response: Cloud-based applications accounted for many of the largest absolute and relative traffic increases across the observed vantage points.The discussion connects this pattern with cloud flexibility, elasticity, and increasing cloud-provider connectivity.
- Infrastructure response: Traffic changes included shifted daily timing and altered composition, while operation generally required only some port-capacity upgrades.The paper reports that operators could add capacity quickly despite challenges accessing data centers during lockdown.
- Infrastructure response: The Internet core handled the observed traffic shifts surprisingly well, which the paper attributes in part to operator preparedness and rapid responses to demand.The discussion emphasizes the unusual speed and scale of the behavioral change.
10 CONCLUSION
Using flow data from multiple edge and core vantage points, the paper characterizes how lockdown reshaped Internet traffic. It finds major timing, volume, directionality, and application changes while concluding that the observed Internet infrastructure coped well.
- Conclusion: Multiple vantage points spanning a large academic network, a large ISP, and Internet-core locations provide a broad view of lockdown traffic effects.The paper uses network flow data from both edge and core perspectives.
- Conclusion: More than 200% increases occurred for remote-working and education applications, including VPN and video conferencing.Morning and late-evening traffic increased, while workday and weekend patterns became less distinct.
- Conclusion: Educational networks serving university campuses saw lower overall demand but drastic increases in applications enabling remote working and lecturing.The conclusion contrasts overall absence-of-user effects with application-specific remote access growth.
- Conclusion: The Internet coped well with unseen and rapid traffic shifts from the perspective of the study’s vantage points.The paper links this resilience to the Internet’s distributed nature and its role in societal resilience.
A TRAFFIC CLASSIFICATION
The paper uses vantage-point-specific traffic classifications to analyze pandemic trends, combining ASes, ports, and application filters. These classifications are representative rather than exhaustive and differ across network types and locations.
- No established comprehensive flow-data classification exists, so the authors compile vantage-point-specific classifications from scientific work, service documentation, and public databases.
- The classifications vary because local content providers, ISP mixes, IXP membership, and network types differ across countries and vantage points.
- The hypergiant category covers 15 large ASes but cannot provide insight beyond those networks.
- Academic-network analysis includes VPN, SSH, remote desktop, and entertainment applications, while application categories may overlap.
- The ISP/IXP classification combines ASes with transport-protocol ports and supports comparison across those vantage points.
B ADDITIONAL PLOTS FOR LINK UTILIZATION
Additional plots compare IXP-CE link utilization across lockdown-related weeks against a February reference week. They show increased overall utilization at IXP-CE.
- The April and June plots show increased overall link utilization at IXP-CE relative to the February reference week.
- Figures 14 and 15 compare IXP-CE minimum, average, and maximum link-utilization distributions across February, April, and June weeks.
C ADDITIONAL PLOTS FOR APPLICATIONS BY PORT CLASSIFICATION
Additional application-port plots examine lockdown and post-lockdown traffic changes at IXP-CE and ISP-CE. They compare selected periods with February baselines and extend the analysis to weekend hours.
- Figures 16 and 17 emphasize changes during lockdown and its lifting relative to regular February 2020 traffic.
- Figures 16 and 17 compare normalized hourly traffic differences by top application ports in IXP-CE and ISP-CE against the February base week.
- Figures 18 and 19 examine application-port traffic changes by hour on weekend days at IXP-CE and ISP-CE.