It’s hard to believe, but students are now in their third year of schooling while dealing with COVID-19. During each year – and each interruption – Cybera has seen wildly different network traffic patterns. While I do plan to write about our experience as a whole, I’ll save that for the post-new normal. For now, I’d like to highlight the first two months of this school year (Sept – Oct 2021).
The following data isn’t a complete picture of our member network traffic. I’m going to focus solely on our Calgary and Edmonton SuperNet-based traffic for two reasons:
- It’s easier for us to aggregate and report on this traffic, which helps with accuracy.
- The majority of our SuperNet-based members are K-12 schools, so that helps create a standardized category of information, as opposed to mixing K-12 and post-secondary members, who are very different from one another.
Before I begin, here’s what September and October 2020 looked like on our network:
You can see the tail end of the summer showed low traffic. Then it steadily increased until the network traffic reached a normal rate of approximately 15 Gb/s per school day. The “valleys” seen here were the weekends.
Now here’s September and October 2021:
The first thing you’ll notice is that we have many more peaks and valleys – daily, actually – as opposed to the weekly peaks and valleys seen the previous year. This is a side effect of “metric data resolution.” Historically, our network data has been stored in a format where resolution gets lost as time goes by, in order to retain disk space.
The idea was that, when someone reviewed historical data, they would only be interested in low precision results – why would anyone need to know the hour-by-hour patterns of five years ago? That’s crazy talk!
Nowadays, metric storage technology is much more realistic about the need for these details, and we’re able to retain a higher resolution – hourly updates for 10 years, to be exact. And while we can’t fix our older data, we’re at least set for the future.
Anyway, back to the current data. You can see right away that in the last two months, we’ve blown past our old average of 15 Gb/s, and are regularly hitting 20 Gb/s per day. Exact values can be lost when creating graphs, so let’s do some Blade Runner style enhancing and zoom in on the last seven days (at the time of writing):
We peaked at 25.5 Gb/s on October 26 – that’s a record for us.
(Good thing we doubled our capacity earlier this year! Either we’re lucky, or we have an incredibly perceptive network team who don’t get showered in gifts nearly as much as they should.)
Looking at the previous Sept-Oct graph, another interesting thing to note is how the first couple of weeks showed a consistent pattern. Mondays were generally the slowest days, working up to Thursday, the busiest day, and then slowing back down on Friday before the weekend.
But then something happened on Monday, October 18: a huge uptick in network use. This kind of random change in behaviour is actually something we’ve observed for the past three school years, but not to this extent.
Not only are we seeing an increase in traffic compared to last year, but there’s an even larger increase that happened in the last two weeks of October. What’s going on?
We’ve been able to correlate this increase in SuperNet traffic with peering traffic. At the moment, we can’t accurately separate SuperNet-based peering traffic from all peering traffic, so here’s a snapshot of peering for all our members over the last two months:
Again, because a little accuracy is lost when we graph over several weeks, let’s yell at the monitor to “enhance” and zoom in on the past week:
We hit a peak of 40.3 Gb/s on October 26. That’s another record.
Transfer rates are all well and good, but we need to look at the top destinations of this traffic, to give us a better sense of what’s happening.
In addition to tracking core network metrics, such as input and output rates, we’ve also begun tracking “NetFlow” data, which can give us a more detailed view of our traffic.
*It's important to note that, while NetFlow-based information is being analyzed, Cybera is not obtaining or recording identifiable information, nor are we doing any kind of packet inspection. Our NetFlow analysis is simply the source and destination of traffic that flows through our network.
The above pie chart shows the top destinations of traffic going through CyberaNet on the afternoon of October 26.
Google is the clear leader here, with just a hair over 50% of the total destination traffic. Next is Microsoft with approximately 30% of the traffic. CANARIE in third place represents general traffic going across the Research and Education Network. Amazon and Facebook have fourth and fifth place, respectively.
Some of the traffic surges can be explained by upgrades (such as the ChromeOS upgrade), but not all of them. This is a mystery that will require further investigation.
Conclusion
Although we’re only two months into this current school year, we’ve already broken data transfer records, sometimes two and three times over. Fortunately, we’re able to look at this in awe rather than fear due to the constant planning and upgrading our network team does throughout the year. We’ve been able to keep up with the demand of our members and, since unmetered peering is part of our membership, help save them a ton of money, too.
If you have any ideas what could be causing the crazy traffic increases, please let us know in the comments below (or send our network team a note).
+1 for the reference to Blade Runner