Countering the spread of coronavirus has spurred the transformation of business processes around the world. The most effective control measure against COVID-19 was isolation, which forced us to switch to remote work and training. This has already led to a general increase in Internet traffic and the geographical redistribution of its flows. Peer centers vying to report record volumes of traffic. Network load is growing due to:- the surge in the popularity of online entertainment: streaming services and online games,
- increase the number of users of distance learning platforms,
- increased use of video for business and informal communication.
Standard "office" traffic from business centers goes to the network of operators that serve individuals. In the DDoS-Guard network, we are already seeing a decrease in the traffic of B2B providers from among our customers amid a general growth.In this post we take a look at the traffic situation in Europe and Russia, share our own data, give a forecast for the near future and tell what, in our opinion, should be done now.
UFO Care Minute
The pandemic COVID-19, a potentially severe acute respiratory infection caused by the SARS-CoV-2 coronavirus (2019-nCoV), has officially been announced in the world. There is a lot of information on Habré on this topic - always remember that it can be both reliable / useful, and vice versa.
We urge you to be critical of any published information.
Wash your hands, take care of your loved ones, stay at home whenever possible and work remotely.
Read publications about: coronavirus | remote work
Traffic Statistics - Europe
This is how the total traffic volume in a number of large European peer centers has changed since the beginning of March: DE-CIX, Frankfurt + 19% , DE-CIX, Marseille + 7% , DE-CIX, Madrid + 24% , AMS IX, Amsterdam + 17% , INEX, Dublin + 25% . The following graphs are compiled.
On average, in 2019, video streaming accounted for 60 to 70% of all Internet traffic - mobile and stationary. According to DE-CIX Peer Center, FrankfurtThe traffic of video conferencing applications (Skype, WebEx, Teams, Zoom) has doubled in the last two months. Traffic related to entertainment and mostly informal socializing. networks, also increased significantly - + 25%. The number of users of online games and cloud gaming services in the third week of March alone doubled. In March, an all-time traffic peak of 9.1 Tbps was reached at the peer center DE-CIX .As the first measures to reduce the load on the networks of operators YouTube, Amazon, Netflix and Disney will reduce the maximum bitrate (quality) of video in the EU in response to the call of European Commissioner Thierry Breton. It is expected that for NetFlix it will lead to a 25% reduction in European traffic at least for the next 30 days,Disney has similar forecasts . In France, the launch of the Disney Plus streaming service was postponed from March 24 to April 7. Microsoft also had to temporarily limit the functionality of some Office 365 services due to the increased workload .Traffic Statistics - Russia
The transition to remote work and training in Russia occurred later than in Europe in general, and a sharp increase in the use of Internet channels began in the second week of March. In some Russian universities, traffic increased 5-6 times due to the transition to distance learning. Total traffic in MSK IX, Moscow increased by about 18%, and by the end of March reached 4 Tbps.In the DDoS-GUARD network, we are registering even greater growth: since March 9, daily traffic increased by 3-5% per day and in 10 days increased by 40% compared to the average for February. For the next 10 days, daily traffic fluctuated around this value with the exception of Monday - March 26, a peak of 168% was reached relative to the same period in February.By the last weekend of March, traffic decreased by 10% and amounted to 130% of the February figures. This is apparently due to the fact that some Russians celebrated the last weekend before quarantine in nature. Our forecast until the end of the week: stable growth to values of 155% of February values or more.
Redistribution of load due to the transition to remote work can also be traced on the traffic of our customers. The screenshot below shows a graph with the traffic of our client - B2B provider. Over the month, incoming traffic decreased, despite the frequent DDoS attacks, and outgoing traffic, on the contrary, increased. The business centers that the provider serves are primarily traffic consumers, and a decrease in incoming data reflects their closure. Outgoing traffic has increased due to the fact that the demand for content that is placed or produced on its network has increased.
* In the screenshot, a fragment of the interface of the personal account of the DDoS-GUARD client
The upward trend in content consumption is well demonstrated by the traffic of our other client - a video content generator. At certain points in time, outgoing traffic bursts occur up to + 50% (similar to publishing “hot” content).
* In the screenshot, a fragment of the interface of the personal account of the DDoS-GUARD client
And here is the increase in web traffic that is processed on our network:
In NNI, the increase is up to 68%. The difference between traffic sent to site visitors (above zero) and received from client web servers (below zero) is growing due to an increase in the amount of static content (CDN) cached on our network.In general, online cinemas in the Russian Federation, unlike their Western counterparts, stimulate traffic growth . Amediateka, Kinopoisk HD, Megogo and other services temporarily expanded the amount of free content or even made the subscription free, without fear of excessive load on the infrastructure. In the coming month, NVIDIA also provided Russian gamers with free access to the cloud-based gaming service NVIDIA GeForce Now .All this creates a significant load on the networks of Russian telecom operators and in some cases is accompanied by a degradation of the quality of services.Forecasts and recommendations
By order of Sergei Sobyanin from this Monday (March 30), a home self-isolation regime is introduced for all residents of Moscow, regardless of age. In fact, leaving the apartment / house is allowed only in case of emergency. Russian Prime Minister Mikhail Mishustin has already called on all regions to follow the example of Moscow. At the time of publication of the article, 26 regions of Russia had already introduced a regime of self-isolation. Therefore, we expect that this week the traffic growth will be even more significant. Perhaps we will reach 200% of the average daily traffic in February, due to the massive consumption of content.As a quick solution to broadband access, providers will actively use DPI to depriorize certain categories of traffic, such as BitTorrent. This will allow at least temporarily ensuring the stable operation of critical (according to the provider) client applications. Other services will compete for channel resources. In such conditions, any custom protocol and tunnels (GRE and IPIP) as a means for delivering traffic will be extremely unstable. If you do not have the opportunity to abandon tunnels in favor of dedicated channels, then it makes sense to try to route the tracks through several operators, distributing the load.Conclusion
In the long term, the load on the networks of operators will continue to increase due to the massive transfer of companies to remote work. The situation is clearly illustrated by the securities market. For example, shares in Zoom’s video conferencing service have nearly doubled in the past two months (NASDAQ). The most logical solution for operators will be the expansion of external channels, including through additional private peer-to-peer (PNI) with those AS, with which traffic is growing most rapidly. In these circumstances, operators simplify the conditions and reduce the requirements for connecting PNI, so now is the time to send requests. We, in turn, are always open to suggestions (AS57724 DDoS-Guard).Moving a business to the clouds will increase congestion and increase the importance of the availability of services that support its operation. Under such conditions, the potential economic damage from DDoS attacks will increase. The daily growth in legitimate traffic volumes (see the graph of content consumption growth above) leaves providers with less and less free channel capacities for receiving attacks without affecting client services. It is difficult to make forecasts with specific figures, but it is already clear - the current situation will lead to an increase in the corresponding shadow market and an increase in the number of DDoS attacks motivated by unfair competition in all areas of the economy. We recommend not to wait for the “perfect storm” in the carrier network, but already now take measures to increase the resiliency of our networks / services. Increased demand for information security services,including protection against DDoS attacks, it can provoke a rise in prices and a change in charging methods and various kinds of speculation.During this difficult time, our company decided to contribute to the fight against the consequences of the pandemic: we are ready to temporarily increase commits (prepaid lane) and available channel capacity without surcharge for both existing and new customers. You can apply with a corresponding request through a ticket or by e-mail info@ddos-guard.net. If you have a website, you can order and connect our free protection and website acceleration .Against the background of the isolation trend, the development of online services and network infrastructure will continue.