The Lockdown Effect: Implications of the COVID-19 Pandemic on Internet Traffic

• Traffic demands at Central and Southern European vantage points rose by more than 20% after lockdowns, while the US East Coast IXP increase lagged and ISP demand fell toward May.IXP traffic increases persisted longer than ISP demand, which declined quickly toward May.Source: §1 · p. 2
• 15-20% traffic increases at the ISP/IXPs contrasted with decreases of up to 55% at EDU; after restrictions eased, increases remained 20% at IXP-CE but only 6% at ISP-CE.Source: §1 · p. 3
• Most traffic increases occurred during non-traditional peak hours as daily traffic patterns shifted toward weekend-like behavior.After confinement measures began, almost all days were classified as weekend-like; the shift weakened as countermeasures were relaxed in mid-May.Source: §1 · pp. 2–3
• Entertainment contributed to a hypergiant traffic surge, while the relative traffic share of essential applications such as VPN and conferencing tools rose by more than 200%.Traffic shares for education, social media, and, during some periods, CDNs decreased substantially.Source: §1 · p. 3
• IXP port utilization increased mostly because of residential demand, while EDU workday traffic dropped after easing even as incoming email and VPN traffic surged.The educational network’s overall traffic shift was antagonistic yet complementary to changes at the other vantage points.Source: §1 · p. 3

2 DATASETS

• The datasets cover an ISP, three IXPs, Madrid’s REDImadrid academic network, and a Central European mobile operator.The ISP serves more than 15 million fixed-line subscribers; REDImadrid connects 16 universities and research centers and serves nearly 290,000 users.Source: §2 · p. 3
• The ISP contributes NetFlow from border gateways to study subscriber demand and from border routers to examine effects on companies running their own ASNs.It operates a Tier-1 transit network and does not host content delivery servers inside its network.Source: §2 · p. 3
• The three IXP datasets use IPFIX; REDImadrid data comprises 5.2B flows captured at border routers over 72 days from Feb 28 to May 8, 2020.The IXPs are located in Central Europe, Southern Europe, and the US East Coast.Source: §2 · p. 3
• Traffic is normalized by minimum volume for selected-week plots and by the median of the first ten weeks of 2020 for longer time series.The study uses continuous data from Jan 1 to Jun 24, 2020, for general trends and compares 7-day periods before, during, after, and well after lockdown.Source: §2 · pp. 3–4

2.1 Ethical Considerations

• Analyses use flow headers without payloads, hash IP addresses, and remain on network-premises servers; EDU data analysis received institutional IRB approval.Only aggregated statistics leave the analysis process.Source: §2.1 · p. 4

3.1 Macroscopic Analysis

• Traffic after lockdown rose by more than 20% at ISP-CE and by 30%/12%/2% at IXP-SE/IXP-CE/IXP-US, respectively.After restrictions eased, growth declined at ISP-CE but persisted at IXP-CE and IXP-SE; IXP-US growth continued with its later lockdown.Source: §3.1 · p. 4
• After lockdown began, ISP-CE traffic shifted toward earlier daytime increases, a lunchtime dip, and late-evening peaks, with a more weekend-like pattern.The pattern became less pronounced after restrictions eased. Across IXPs, daytime traffic increased, while the US East Coast increase was delayed until April and time-of-day effects were less pronounced.Source: §3.1 · p. 4

3.2 Hypergiants

• During weekday working hours, hypergiants grew 40% while other ASes grew by more than 60% after lockdown.By mid-May the difference had narrowed, but increases during weekday working hours remained substantial.Source: §3.2 · p. 4, Figure 4 · p. 5

3.3 Link Utilization Shifts

• IXP-CE link utilization shifted slightly lower during lockdown, while many non-hypergiant ASes showed changes in link usage.Capacity upgrades or switching to PNIs may explain the shift, and upgrades by one network can conceal increased usage by another.Source: Figure 5 · p. 5, §3.3 · p. 5

3.4 Remote-work Relevant ASes

• For most ASes, traffic changes correlated with traffic involving eyeball networks, though some ASes had growing residential traffic despite falling total traffic.The analysis focused on ASes whose workday traffic dominated weekend traffic; some ASes also had major total-traffic shifts with almost no residential traffic, and the other AS groups showed weaker correlation.Source: Figure 6 · p. 5, §3.4 · pp. 5–6
• Some ASes therefore needed to provision significant extra capacity to support unforeseen traffic demands during lockdown.The analysis used ISP-CE transit traffic and traffic to and from manually selected regional eyeball ASes to identify workday-, balanced-, and weekend-dominated groups.Source: §3.4 · pp. 5–6

Traffic-port distributions

• Although both networks shared similar top ports, their distributions and changes differed; both saw strong March increases followed by more gradual changes in April and June.The paper relates the differences to the ISP-CE’s subscriber and small-enterprise traffic versus the IXP-CE’s diverse Internet-economy members.Source: §4 · p. 6, Figure 7 · p. 7, Figure 8 · p. 7

Entertainment and service traffic

• QUIC rose 30%–80% at ISP-CE and about 50% at IXP-CE in March, while TV-streaming traffic shifted across the day and Cloudflare traffic rose at IXP-CE in March and June.QUIC’s largest ISP-CE increase occurred in morning hours, while IXP-CE growth was more evenly distributed; QUIC later remained relatively stable, and the TV-streaming increase did not persist.Source: §4 · p. 6

VPN traffic

• VPN-related UDP/4500 and UDP/1194 increased during March working hours, but later UDP/4500 remained above February levels while OpenVPN receded; GRE and ESP fell at IXP-CE.GRE rose slightly at ISP-CE, consistent with increased home VPN use but declining company-to-company VPN connections, the primary source of GRE and ESP traffic.Source: §4 · p. 6

Work and conferencing traffic

• Zoom UDP/8801 rose by an order of magnitude at ISP-CE from February to April, Skype/Teams UDP/3480 increased at IXP-CE during work hours, and ISP-CE TCP/993 rose 60%.Zoom traffic decreased again in June; TCP/993 is used for IMAP over TLS email retrieval.Source: §4 · pp. 6–7

Summary

• Work- and entertainment-related port traffic increased, and ISP-CE workday traffic rose sharply in the morning in March compared with February’s steadier all-day growth.These shifts reflect people working and studying from home during lockdown.Source: §4 · p. 7

Application classification

• The study classified traffic using over 50 port-and-AS combinations and aggregated it into eight end-user application classes.Comparisons cover a base week and three lockdown-stage weeks, normalized and filtered to remove 2–7 am hours; differences from the base week were visualized, with changes beyond +200% or below −100% removed.Source: §5 · pp. 7–8

Gaming

• At IXP-SE, gaming IP counts and traffic volumes rose steeply from lockdown week 10, despite a two-day dip linked to a large-provider outage.The analysis used five gaming providers and 57 typical gaming ports; the metrics were distinct source IPs as a proxy for households and traffic volume. The outage was verified as not a measurement artifact and may have been related to the sudden increase in users.Source: §5 · p. 8, Figure 9 · p. 8

Communication-related applications

• Web conferencing increased by more than 200% during business hours at all vantage points, while collaborative-work growth and email trends varied by network.Web conferencing also grew on weekends at ISP-CE, IXP-SE, and IXP-US; ISP-CE saw its largest growth in March after lockdown, with a less pronounced trend in June. Email declined at IXP-CE and IXP-SE but rose at ISP-CE, less than web conferencing.Source: §5 · p. 8, Figure 10 · p. 9

Entertainment-related applications

• VoD streaming grew by up to 100% at European IXPs, while ISP-CE saw about 10% growth during lockdown; gaming growth was coherent across all three IXP vantage points, especially during the day.ISP-CE VoD traffic dropped back to February levels in June. IXP-US VoD measurements covered only three ASes, and its decrease may reflect a traffic-engineering decision.Source: §5 · pp. 8–9

Other applications

• Social media rose initially then waned, while educational traffic rose by up to 200% at ISP-CE and CDN traffic increased in Europe but was modest or lower in the US.ISP-CE social-media traffic grew 70% in March, with the increase slowing in April; by June, usage was slightly below March levels across vantage points. Educational traffic remained stable at IXP-CE, and CDN losses in the US may reflect rerouting by a large player.Source: §5 · pp. 9–10, Figure 10 · p. 9

6 VPN TRAFFIC SHIFT

• The study identifies VPN traffic through major VPN ports and protocols, and uses DNS-domain data to classify TCP/443 traffic to candidate VPN addresses.For a conservative TCP/443 estimate, it excludes candidate IPs shared by a VPN-labeled domain and its corresponding www domain; 1.7 million candidate VPN IP addresses remain.Source: §6 · p. 10
• More than 200%: domain-identified VPN traffic increased during workday working hours in March compared with the February base week.Weekend increases were less pronounced; traffic remained above February levels in April and June, though it declined from March. The authors associate June’s decline with easing restrictions and summer holidays.Source: §6 · p. 10
• Port-based identification showed almost no change, indicating that port-only methods vastly undercount VPN traffic, much of which uses TCP/443 on VPN domains.The authors propose using domain data to identify seemingly HTTPS flows as VPN traffic for a more accurate view of VPN activity.Source: §6 · p. 10

7 EDUCATIONAL NETWORK

• Working-day traffic volume fell by up to 55%, while weekend traffic rose 14% on Saturday and 4% on Sunday; overnight traffic increased 11%–24%.Workdays and weekends became more similar. June was excluded because academic activity fell as the semester ended, and summer historical captures were unavailable.Source: §7 · pp. 10–11, Figure 12 · p. 11
• Median daily connections rose 24% after the emergency declaration; incoming connections doubled while outgoing connections fell by almost half.The ingress-to-egress traffic ratio also halved during the transition and was lowest in the week of online lecturing, as users accessed academic services from outside the network.Source: §7 · p. 11
• Incoming web connections increased by over 77%, while outgoing web connections fell by more than half.Outgoing connections to push-notification and mobile services decreased by 65% on average, while those to Spotify fell by 83%; outgoing web traffic to hypergiants or QUIC also dropped sharply.Source: §7 · pp. 11–12, Figure 13 · p. 12
• Incoming connection growth was 1.7x for web, 1.8x for email, 4.8x for VPN, 5.9x for Remote Desktop, and 9.1x for SSH.Incoming web connections grew 2.8x from domestic eyeball ISPs; out-of-time access also came from Latin American and North American eyeball ASes, with Latin American connections peaking overnight. VPN, web, and Remote Desktop timing patterns correlated, while SSH was irregular.Source: §7 · p. 12
• Academic-network lockdown shifts were antagonistic to those observed at residential ISPs.The network connected 16 universities and research centers in metropolitan Madrid; its users shifted teaching and research activities home after educational closures.Source: §7 · pp. 10, 12

8 RELATED WORK

• Earlier Internet measurements examined 9/11, earthquakes, severe weather, power outages [1], and major software roll-outs [2].The 9/11 study found the Internet robust overall, with unexpected outages limited to local impact; the paper argues COVID-19 is unique given the Internet’s increased importance and the pandemic’s global reach.Source: §8 · p. 12
• Pandemic studies included remote learning by 16k students [26] and campus Wi-Fi analyses [69], while this study found European mobility fell drastically under stricter lockdowns.The Politecnico di Torino study used an in-house teaching solution; the campus Wi-Fi study found campus activity decreased but mobility did not, unlike the drastic European mobility reductions observed here.Source: §8 · p. 12
• Wikipedia access research found increased interest in health topics [54], especially in countries at the pandemic’s epicenter.Source: §8 · p. 12
• Parallel studies examined UK mobile traffic [40], social-network demand, underground-market transactions, and Internet latency across Europe [9].The underground-market study attributed higher transaction volumes to market stimulus rather than the pandemic; the latency study found increased variance in additional latency and packet loss.Source: §8 · p. 12

Internet operation during the pandemic: a success story

• Cloud-service flexibility and connectivity, over-provisioning, network management, and automation helped networks sustain the unexpected demand.Most applications with the highest absolute and relative increases were cloud-based; automated operations also enabled rapid capacity additions, including new IXP ports.Source: §9 · p. 13

Taming the traffic increase

• 15-20% traffic growth occurred within days of lockdowns, while most of the increase filled working-hour valleys and peak traffic rose moderately.The study found no evidence that pandemic-related traffic shifts affected operation at its vantage points, although some individual links saw drastic increases; smaller networks with limited spare capacity or slower response times may be less able to absorb sudden demand.Source: §9 · p. 13

Substantial shift in traffic pattern

• The pandemic substantially shifted traffic patterns and composition, showing that operators need to prepare for rapid changes in user behavior.Operators added port capacity, and some networks outside the study reported partial connectivity issues and a need for new interconnections.Source: §9 · p. 13

10 CONCLUSION

• The analysis combines network-flow data from a large academic network and a large edge ISP with measurements from three European and US IXPs to assess lockdown effects in more developed countries.The authors describe these vantage points as providing a good understanding of the lockdown effect on Internet traffic in more developed countries.Source: §10 · p. 13
• Remote-working and education applications, including VPN and video conferencing, saw traffic increases beyond 200%, while university networks had lower overall demand but sharp increases in remote-working and lecturing applications.The study also finds that some networks’ traffic ratios, including sources and destinations, differed radically from the pre-pandemic scenario.Source: §10 · p. 13
• Traffic shifted toward mornings and late evenings, workday patterns changed rapidly toward weekend patterns, and traffic engineering should consider essential remote-working applications beyond hypergiants and popular traffic classes.The study also reports radically different traffic ratios, including sources and destinations, for some networks compared with the pre-COVID-19 scenario.Source: §10 · p. 13
• From the vantage points studied, the Internet coped well with unseen and rapid traffic shifts, while related work reported performance degradation in less developed regions.The authors connect the Internet’s distributed nature with its ability to react to confinement-driven shifts and support society’s resilience.Source: §10 · p. 13

A TRAFFIC CLASSIFICATION

• No established comprehensive flow-to-class classification exists; schemes may vary by country, network type, and classification difficulty, so the authors compile vantage-specific categories from prior research, service documentation, and public databases.Source: A TRAFFIC CLASSIFICATION · p. 15
• The classifications aim to capture representative traffic subsets for pandemic trends, not all traffic; non-disclosure agreements restrict what classification details can be published.Source: A TRAFFIC CLASSIFICATION · p. 15

A.1 Hypergiants Classification

• The authors adopt Böttger et al.’s established classification of 15 hypergiant ASes, which covers only a few very large networks.Source: §A.1 · p. 15, Table 2 · p. 15

A.2 Application Classification Academic Network

• Academic-network classification targets expected staff and student uses, including VPN, SSH, remote desktop applications, and entertainment such as Spotify.Source: §A.2 · p. 15
• Academic filters cover conferencing, VoD, gaming, social media, email, education, collaborative work, and CDNs; categories may overlap, as QUIC is a subset of Web.Source: Table 3 · p. 15, §A.2 · p. 16

A.3 Application Classification ISP/IXPs

• Because ISP and IXP networks have comparable traffic mixes, the authors use a joint classification based on ASes and characteristic transport ports, withholding measured ASes under non-disclosure agreements.Source: §A.3 · p. 16

• At IXP-CE, April and June plots show increased overall link utilization relative to February; Figure 15 presents June ECDFs for minimum, average, and maximum utilization.Source: B ADDITIONAL PLOTS FOR LINK UTILIZATION · p. 16, Figure 15 · p. 16

C ADDITIONAL PLOTS FOR APPLICATIONS BY PORT CLASSIFICATION

• Figures 16–17 compare hourly application-port traffic changes in IXP-CE and ISP-CE against the regular February 2020 week, rather than consecutive-month weeks.They show March, April, and June relative to the February base week.Source: C ADDITIONAL PLOTS FOR APPLICATIONS BY… · p. 16, Figure 16 · p. 17, Figure 17 · p. 17
• Figures 18–19 add weekend-only hourly application-port traffic changes for IXP-CE and ISP-CE across February, March, April, and June.These plots complement the previously shown workday changes.Source: C ADDITIONAL PLOTS FOR APPLICATIONS BY… · p. 16, Figure 18 · p. 17, Figure 19 · p. 18
• Figures 16–19 omit TCP/80 and TCP/443 traffic for readability.Source: Figure 16 · p. 17, Figure 17 · p. 17, Figure 18 · p. 17