RFC 9075

Report from the IAB COVID-19 Network Impacts Workshop 2020

📅 published July 2021, from ietf

RFC 9075 📚🦋 Report from the IAB COVID-19 Network Impacts Workshop 2020

okay bestie, this one is the IAB (Internet Architecture Board) writing up their COVID-19 network impacts workshop 🌸 It's RFC 9075, filed as Informational 💖 and published in July 2021 ✨ The authors are J. Arkko, S. Farrell, M. Kühlewind, and C. Perkins 🫶 The ISSN is 2070-1721 🎀 It doesn't list anything it obsoletes or updates 💅

Abstract ✨

so the COVID-19 pandemic shook up how people used the Internet 😭 Quarantines and work-from-home happened, and that totally changed Internet traffic 🌈

The IAB ran a workshop about these network impacts on November 9-13, 2020 🎀 It brought together researchers, network operators, network management experts, and Internet technologists to swap experiences 💜 Because travel and contact restrictions were still a thing, it was held online 💻

note that this is a report on what happened at the workshop 🦋 The views in it belong to the workshop participants, and they don't necessarily match IAB views and positions 💅

Status of This Memo 🌸

this one is not an Internet Standards Track specification 🙈 It's published just for information 📖

The IAB put this out, and it's a record of stuff the IAB thought was worth keeping forever 💖 It represents the consensus of the Internet Architecture Board (IAB) ✨ Docs the IAB approves for publication are not candidates for any level of Internet Standard, so see Section 2 of RFC 7841 for the details 🧚

for the current status, any errata, and how to give feedback, check https://www.rfc-editor.org/info/rfc9075 🔥

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. 💜

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they were on the publication date 📜 Please read these carefully, because they spell out your rights and restrictions for this document 🫶

Table of Contents 🧚

1.  Introduction
2.  Scope
3.  Workshop Topics and Discussion
  3.1.  Measurement-Based Observations on Network Traffic Dynamics
    3.1.1.  Overall Traffic Growth
    3.1.2.  Changes in Application Use
    3.1.3.  Mobile Networks and Mobility
    3.1.4.  A Deeper Look at Interconnections
    3.1.5.  Cloud Platforms
    3.1.6.  Last-Mile Congestion
    3.1.7.  User Behavior
  3.2.  Operational Practices and Architectural Considerations
    3.2.1.  Digital Divide
    3.2.2.  Applications
    3.2.3.  Observability
    3.2.4.  Security
    3.2.5.  Discussion
  3.3.  Conclusions
4.  Feedback on Meeting Format
5.  Position Papers
6.  Program Committee
7.  Informative References
Appendix A.  Workshop Participants
IAB Members at the Time of Approval
Acknowledgments
Authors' Addresses

1. Introduction 🌈

so the IAB ran a workshop on how COVID-19 hit the network, from November 9-13, 2020 💻 It was for researchers, operators, network management experts, and Internet technologists to share what they went through 💖 Since travel and contact restrictions were still going, it was online 🫶

okay so COVID-19 changed what users were doing, and that changed Internet traffic 😭 The shifts were fast and huge, especially when quarantine and work-from-home kicked in 🔥 Traffic changed in volume and location, and the mix of apps changed too 🦋 It also shifted security practices and the attack patterns that went after the new attack surface created by working from home during a global crisis 💀

a call for position papers went out in July 2020 📮 In total, 15 position papers came in from 33 authors 🎀 Section 5 lists them ✨ There were also other kinds of contributions and pointers to existing work 🧚 Quite a few position papers referred to parallel work being published at measurement-related academic conferences 💜

invitations went out based on those position papers and other expressions of interest 🌸 The workshop conference calls had 46 participants, all listed in Appendix A 👑

the workshop ran over one week with three sessions: i) measurements and observations, ii) operational and security issues, and iii) future considerations and conclusions 🌟 Those sessions were on Monday, Wednesday, and Friday, which was a lowkey perfect side effect 🙈 The gaps between sessions were great for mailing list discussion and building extra workshop material 💅

2. Scope 🎀

the COVID-19 pandemic absolutely wrecked people's lives and economies around the globe 😭 It also hit networking hard 🌍 With tons of people working from home or otherwise depending on the network for daily life, traffic volume surged 🔥 ISPs and operators reported 20% or more traffic growth in a matter of weeks 📈 IXP traffic was rising too 🌊 Most kinds of traffic went up, and conversational multimedia traffic grew by more than 200% in some cases 🤯 On some conferencing platforms, user time spent on conferencing rose by an order of magnitude 💀

honestly the Internet handled this pretty well overall ✨ It wasn't perfect, since there were outages, video quality dips, and other issues 🙈 Still, it's iconic to watch how the tech, operators, and service providers responded to big changes in traffic patterns 👑

understanding what actually happened to Internet traffic is interesting on its own 🦋 How it affected user experience or what the services were meant to do is just as interesting 💖 So measurements and reports on 2020 Internet traffic are valuable 📊 It would also be fascinating to know what network management and capacity expansion actions got taken in general 🧚 Anecdotes suggest that Internet and service providers tracked how their services were used and often adjusted them for the new traffic patterns 🌸 That ranged from dynamic allocation of computing resources to way more complex changes 💅

the impacts of this crisis are also a chance to understand how traffic shifts and growth affect networking more broadly 🌈 That helps us prep for future situations, crises or otherwise, and lets us adjust the technology so it's even better at handling change 🫶

the scope of the workshop, based on the call for contributions, included:

  • measurements of traffic changes, user experience and problems, service performance, and other relevant aspects 📊
  • discussion about the behind-the-scenes network management and expansion activities 🎀
  • sharing experiences in the fields of general Internet connectivity, conferencing, media/entertainment, and Internet infrastructure 🍓
  • lessons learned on preparedness and operations 🧚
  • lessons learned on Internet technology and architecture 💜

3. Workshop Topics and Discussion 🦋

3.1. Measurement-Based Observations on Network Traffic Dynamics 📊

the workshop kicked off with measurements 💖 A big chunk of the submitted papers presented and discussed measurement data, and those gave us a solid base for understanding the situation from lots of angles across different kinds of networks 🌟

the pandemic changed Internet traffic in different ways for different networks 🌈 Still, every network saw some kind of change 🔥 That could be less traffic, more traffic, a shift in weekday and weekend daily patterns, or a change in traffic classes 💅 Traffic volume, directionality ratios, and where traffic came from and went to were radically different from before COVID-19 💀

at a high level, traffic from home networks went up a lot 🏠 Mobile networks showed different trends 📱 Traffic either went up as well, for instance in places where residential ISP services are less common, or it went down because people were moving around less 🫶 That mobile decrease was kind of the opposite of what was seen on residential ISPs 🙈

diurnal congestion at interconnect points, and in certain last-mile networks, was reported, mainly in March ⚠️ Still, no persistent congestion was observed ✨ A downward trend in download throughput to certain cloud regions was also measured, which can probably be explained by increased use of cloud services ☁️ That's another sign that the scaling of shared resources in the Internet is working reasonably well enough to handle even bigger traffic changes, like the first nearly global lockdown of the COVID-19 pandemic 👑

3.1.1. Overall Traffic Growth

okay so the pandemic absolutely fast-forwarded how much data the world sends 💻✨. The workshop [Feldmann2020] looked at measurements from one ISP, three IXPs, a metropolitan educational network, and a mobile operator, and right at the start they noticed the network handled everything surprisingly well 🫶. Traffic growth spiked hard in March and April, and the Internet still held up. After the lockdown kicked in during March, the ISP and all three IXPs saw traffic go up by 15-20%. Normally that much growth would stretch across a whole year, but it happened in just a few weeks 😭. Iconic, but also a LOT.

At DE-CIX Frankfurt, the world's largest Internet Exchange Point in terms of data throughput, 2020 brought the biggest jump in peak traffic within a single year since the IXP was founded in 1995 🔥. Meanwhile, mobile traffic slightly receded 📱. In access networks, upstream traffic grew faster than downstream, which makes sense because everyone was suddenly on videoconferencing and remote work and school apps 🎀.

Most of the increase happened outside the old peak hours 🌸. Before the first COVID-19 lockdowns, the main time of use was weekday evenings. Since March, usage has been spread more evenly across the day. The growth mostly landed outside the previous peak times (think daytime, while people were working from home). For the first time ever, weekday utilization looked like weekend utilization, which is kind of wild 🙈. The extra volume could be absorbed either by using existing reserve capacity or by quickly switching on additional bandwidth. That's one big reason the Internet coped so well during the first lockdown period 💅.

Some lockdowns were lifted or relaxed around May 2020 🌈. As people were allowed back out for some daily activities, traffic dropped at the IXPs and the ISP, just as expected. Mobile traffic, though, started growing again.

3.1.2. Changes in Application Use

The mix of data traffic changed a lot once the pandemic began. Videoconferencing and virtual private networks (VPNs) for accessing company resources from home went up sharply 💜. In ISP and IXP networks, traffic tied to web conferencing, video, and gaming jumped in March 2020 [Feldmann2020], because people really wanted tools like Zoom or Microsoft Teams. The relative traffic share of many "essential" apps like VPN and conferencing tools went up by more than 200% 🚀.

People were also spending way more hours at home, so they watched more videos and played more games, which pumped up entertainment traffic 🎮. Meanwhile, other traffic classes dropped a lot, like education, social media, and, for some periods, content delivery networks (CDNs) 🥀. In April and June, web conferencing was still high compared to pre-pandemic times, while CDN and social media traffic dipped a little. Lots of people were still working from home, but restrictions had eased, so in-person socializing likely went up and online socializing likely went down 🦋.

3.1.2.1. Example Campus Networks

University campuses felt it too, especially because remote teaching had to happen 🎓. The Politecnico di Torino (Italy) rolled out its own in-house remote teaching solution, and outgoing traffic grew by 2.5 times, driven by more than 600 daily online classes 📈. Incoming traffic went the other way and dropped by a factor of 10, because in-person activity had stopped completely. The measurements showed this change did not lead to noticeable performance impairments, and students in remote regions of Italy didn't see significantly poor performance either ✨. Outgoing traffic also went up because of other remote working tools, like collaboration platforms, VPNs, and remote desktops 💻.

Similar changes showed up when measuring REDIMadrid [Feldmann2020], a European educational and research network connecting 16 independent universities and research centers in the Madrid metropolitan region 🍓. Traffic volume on working days dropped by up to 55% during the pandemic. Just like in the ISP and IXP networks, working days and weekend days started looking more alike in terms of total traffic 🫶. The hourly patterns showed a traffic increase between 9 pm and 7 am 🌙. That could be because users were working at more unusual times, but it could also potentially be caused by overseas students (mainly from Latin America and East Asia, based on the Autonomous System (AS) numbers those connections came from) who were accessing university network resources from their home countries 🌏.

Since users of the academic network (students and research staff) had to leave campus because of lockdown measures, the ingress and egress ratio changed drastically too 🏠. Before the lockdown, incoming traffic was way bigger than outgoing traffic. After it, the ratio became much more balanced. This shift makes sense once you think about remote work. Users were mostly connecting to the network to access resources, which is why outgoing traffic went up. On top of that, external (Internet-based) resources that used to be reached from the educational network during work were now reached from people's homes instead 💅.

3.1.3. Mobile Networks and Mobility

Mobile network data usage seemed to decline after localized lockdown measures were imposed, since those reduced typical levels of mobility and roaming 📵.

[Lutu2020] measured the cellular network of O2 UK to see how changes in people's mobility affected traffic patterns 📶. By analyzing cellular network signaling information about users' device mobility, they observed a 50% decrease in mobility (according to different mobility metrics) across the UK during the lockdown period 😮. There was no correlation between that reduction and the number of confirmed COVID-19 cases, so only the enforced government order was effective at significantly reducing mobility. The reduction was also bigger in densely populated urban areas than in rural ones. For London specifically, the mobile network data suggested that approximately 10% of residents temporarily relocated during the lockdown 🏙️.

These mobility changes had immediate effects on cellular traffic patterns 🌊. The downlink data traffic volume, aggregated for all bearers (including conversational voice), decreased by up to 25% across the entire UK during the lockdown period. This matches the countrywide drop in mobility, and it probably happened because people leaned more on residential broadband to run download-heavy apps like video streaming 📺. Radio cell load fell by approximately 15% across the UK after the stay-at-home order was enacted, which backs up the drop in cellular connectivity usage 📉.

Uplink data traffic volume, on the other hand, barely changed (between -7% and +1.5%) during lockdown 🤏. This was mainly thanks to the increase in 4G voice traffic (Voice over LTE (VoLTE)) across the UK, which peaked at 150% after the lockdown compared to the national median value before the pandemic. That made up for the drop in uplink data traffic 💜.

Finally, mobility changes affected network usage differently across geodemographic area clusters 🗺️. In densely populated urban areas, mobile network usage (downlink and uplink traffic volume, radio load, and active users) dropped much more significantly than in rural areas. For London, this was likely because the central districts have lots of seasonal residents (like tourists) and business and commercial areas 🏢.

3.1.4. A Deeper Look at Interconnections

Traffic at points of network interconnection went up noticeably, but most operators reacted quickly by adding capacity [Feldmann2020] 🔌. The amount of increase varied. Some networks that hosted popular apps like videoconferencing saw traffic growth of several hundred to several thousand percent 🤯. At the IXP level, port utilization went up, which is mostly explained by higher traffic demand from residential users 🏡.

Measurements of interconnection links at major US ISPs, done by the Center for Applied Internet Data Analysis (CAIDA) and the Massachusetts Institute of Technology (MIT), found some evidence of diurnal congestion around March 2020 [Clark2020]. But most of that congestion disappeared within a few weeks, which suggests operators really did take steps to add capacity or otherwise mitigate the congestion 🦸‍♀️.

3.1.5. Cloud Platforms

Cloud infrastructure played a key role in supporting bandwidth-intensive videoconferencing and remote learning tools, so people could practice social distancing during COVID-19 ☁️💖. Network congestion between cloud platforms and access networks could affect the quality of experience of these cloud-based apps 😬. CAIDA used web-based speed test servers to take download and upload throughput measurements from virtual machines in public cloud platforms to various access ISPs in the United States [Mok2020] 🧚.

The key findings were:

  • Persistent congestion events were not widely observed between cloud platforms and these networks, especially for large-scale ISPs. Still, we could observe large diurnal download throughput variations in peak hours from some locations to the cloud 📊.
  • There was evidence of persistent congestion in the egress direction to regional ISPs serving suburban areas in the US 🏘️. Their users could have suffered from poor video streaming or file download performance from the cloud 😭.
  • The macroscopic analysis over 3 months (June-August 2020) revealed downward trends in download throughput from ISPs and educational networks to certain cloud regions 📉. We believe that increased use of the cloud during the pandemic could be one of the factors that contributed to the decreased performance 💜.

3.1.6. Last-Mile Congestion ✨

okay so the last mile is literally the main character of broadband 💅 like, if the last mile is bad, your whole experience is bad, no cap. A recent Internet Measurement Conference (IMC '20) paper by Fontugne et al. looked at last-mile latency using traceroute data from RIPE Atlas probes in 646 ASes, hunting for recurring performance drops [Fontugne2020-1]. In normal times, the probes saw persistent last-mile congestion in only 10% of ASes 🫠, but during the COVID-19 outbreak they recorded 55% more congested ASes 😭. The stay-at-home measures hit hardest in networks with a huge number of users and in certain parts of the world 🌍. Japan was the most impacted country in their study, specifically the Nippon Telegraph and Telephone (NTT) Corporation Open Computer Network (OCN), and they saw similar patterns across several other Japanese networks too, including Internet Initiative Japan (IIJ) (AS2497) 🇯🇵.

Then it gets better 🌈. From mid-2020 onward, performance was actually better than before the pandemic. In Japan, that was partly thanks to upgrades originally planned for the Tokyo Olympics 🏅, and more broadly, network operators were scrambling to cope with these exceptional circumstances and honestly serving 👑. The pandemic showed that the Internet's adaptive design and its proficient community can keep things running through unprecedented events 🫶. Plus, based on the many research and operational reports published lately, the pandemic seems to be shaping a more resilient Internet, and as Nietzsche put it, "What does not kill me makes me stronger" 💪✨. Iconic behavior, honestly.

3.1.7. User Behavior

the type of traffic users needed also shifted in 2020 🦋. Upstream traffic went up because of videoconferencing, remote schooling, and similar apps. The National Cable & Telecommunications Association (NCTA) and Comcast reported that downstream traffic grew 20%, but upstream grew by as much as 30-37% [NCTA2020] [Comcast2020]. Vodafone said upstream traffic doubled, growing by 100%, in some markets [Vodafone2020] 🤯.

Ericsson's ConsumerLab surveyed users about their usage and experiences during the crisis 📋. Some of the key findings in [ConsumerlabReport2020] were:

  • 9 in 10 users increased their Internet activities, and time spent connected went up 📱. Also, 1 in 5 started brand-new online activities 🌟. Many people in the older generation felt helped by video calling 💕, parents felt their children's education was helped 🎒, and so on.
  • Network performance was generally found satisfactory 🙌. 6 in 10 were very satisfied with fixed broadband, and 3 in 4 felt mobile broadband was the same or better than before the crisis 📶. Consumers said resilience and quality of service were the most important responsibilities for network operators 💖.
  • Smartphone app usage changed a lot 📲. The fastest growth was in apps for COVID-19 tracking and information, remote working, e-learning, wellness, education, remote health consultation, and social shared experiences 🧘. The biggest drops were in travel and booking, ride hailing, location, and parking apps 🚗💀.

Some of these behaviors are probably permanent changes [ConsumerlabReport2020] 🔮. Video calls and other new services, especially among the older generation, are likely to have a long-lasting effect 📞. Surveys across various organizations also point to a likely long-term increase in the number of people interested in remote work [WorkplaceAnalytics2020] [McKinsey2020] 🏠💜.

3.2. Operational Practices and Architectural Considerations

the second and third days of the workshop were all about open discussions on operational and architectural issues that were arising 🗣️. They also covered conclusions that could be drawn from earlier discussions and other issues raised in the position papers 📝.

3.2.1. Digital Divide

Measurements from Fastly confirmed that Internet traffic volume rose fast in multiple countries 📈 while COVID cases were climbing and lockdown policies were kicking in 😷. Download speeds dropped too, but way less dramatically than the jump in overall bandwidth usage 🙃. School closures caused a massive traffic spike in many regions, and other public policy announcements triggered big traffic shifts 🔀. So the takeaway is that governments should coordinate with operators, giving them time to make preemptive operational changes in some cases 🤝. Bestie, that's just good planning ✨.

Measurements from the US showed that download rates correlate with income levels 💸. But here's the twist 👀: download rates in the lowest income zip codes went up as the pandemic went on, closing the gap with higher income areas. One possible reason in the data is that some ISPs, such as Comcast and Cox, increased speeds for users on certain lower-cost plans and in certain areas 🚀. This suggests network capacity was available, and the income-download correlation wasn't necessarily caused by differences in the deployed infrastructure across regions 🏘️. It was noted, though, that certain access link technologies give more flexibility than others in this regard 🧵.

3.2.2. Applications

Web conferencing systems (e.g., Microsoft Teams, Zoom, Webex) saw incredible growth 🚀, with overnight traffic increases of 15-20% in response to public policy changes like lockdowns. That required significant and rapid changes in infrastructure provisioning 🛠️.

Major video providers (YouTube, etc.) reduced their bandwidth by 25% in some regions 📉. It was suggested this had a huge impact on videoconferencing quality until networks could scale to handle the full bit rate 😬. Other operators of some other services saw limited impact 🤷‍♀️.

Updates to popular games have a significant impact on network load 🎮. Some discussions took place between ISPs, CDNs, and the gaming industry about possibly coordinating various high-bandwidth update events, similar to what was done for entertainment and video download speeds 🗓️. There was an apparently difficult interplay between bulk downloads and interactive real-time applications, potentially due to buffer bloat and queuing delays 🥴.

It was noted that operators have experience with rapid Internet traffic growth 🧠. New applications with exponential growth aren't that unusual on the network, and the lockdown traffic spike wasn't that unprecedented for many. Plenty of operators already have tools and mechanisms to deal with this 🧰. The challenge is making sure that knowledge gets shared 📣.

Following these observations, traffic prioritization was discussed, starting from Differentiated Services Code Point (DSCP) marking 🏷️. The question was whether a minimal priority-marking scheme would have helped during the pandemic, for example by allowing marking of less-than-best-effort traffic 🤔. The discussion quickly turned into a broader QoS and observability conversation, and it also touched on the effects of increased encryption 🔐. The group, unsurprisingly, couldn't resolve all the different perspectives and interests involved 😅, but the discussion showed that progress was made 🌸.

3.2.3. Observability

there's a clear contrast in experience here 👀. Many operators reported few problems in terms of metrics like measured download bandwidth 📊, while videoconferencing apps had significant usability problems running on those same networks 😵‍💫. The interaction between application providers and network providers worked very smoothly to resolve these issues, backed by strong personal contacts and relationships 💞. But it seems clear that the metrics many operators use to understand network performance don't fully capture the impact on certain applications, and that's an observability gap 🕳️. So, do we need more tools to figure out the various impacts on user experience? 🧐

These types of applications use surprisingly large amounts of Forward Error Correction (FEC) 🧩. Applications hide lots of loss to keep the user experience good 🙈, which makes problems harder to observe. The network can be behaving poorly while the experience is still good enough 😶‍🌫️. Resiliency measures can improve user experience but also hide severe problems 🫥. There may be a missing feedback loop between application developers and operators 🔁.

It's clear that application providers and operators find it difficult to isolate problems. Is the problem the local Wi-Fi, the access network, the cloud network, or something else? 📶☁️ Metrics from access points would help, but in general, lacking observability into the network as a whole is a real concern when debugging performance issues 🔍.

Further, it can be difficult to route problem reports to the person who can actually fix them, especially if the reported information has to be shared across multiple networks in the Internet 📨. COVID-enhanced cooperation made it easier to debug problems, and lines of communication really matter 💬🫶.

3.2.4. Security 🔐

okay so the COVID-19 era gave security people a LOT to deal with, and it comes down to two big problems: (1) bad actors spinning up new scams fast using COVID-19 as bait, and (2) a massive increase in attack surface when everyone suddenly started working from home 😭

During 2020, a lot of people moved to home working, and the way they used the network changed too. IT departments rolled out new equipment super fast and used VPNs for the very first time, while others had existing setups suddenly under way more load. As VPN tech got more popular and more people used it, it became a juicier target 🎯. One Advanced Persistent Threat group (APT29) got initial footholds by using recently published exploits against a range of VPN software [Kirsty2020]. Not okay, but iconic for the attackers, I guess 💀

Of all the scams the United Kingdom National Cyber Security Centre (UK NCSC) detected that pretended to come from the UK Government, more were about COVID-19 than anything else 🙃. There are also other reports of a strong rise in phishing, fraud, and scams related to COVID [Kirsty2020]. Overall cybercrime levels haven't gone up based on the data so far, but there was definitely a shift in what attackers were doing. Both the NCSC and the Department of Homeland Security Cybersecurity and Infrastructure Security Agency (DHS CISA) saw more COVID-19 themes being used by malicious cyber actors as bait 🪤. Attackers sent COVID-19 scams and phishing emails to individuals, small and medium businesses, large organizations, and organizations involved in national and international COVID-19 responses (healthcare bodies, pharmaceutical companies, academia, and medical research organizations) 🏥. New targets, like organizations working on COVID-19 vaccine development, got hit with VPN exploits, which is a super clear reminder of what can happen when infrastructure is vulnerable 🚨.

It's unclear how to detect and counter these attacks at scale, and that's the tricky part 🥲. Approaches like using Indicators of Compromise and crowdsourced flagging of suspicious emails were found to work well against COVID-19-related scams [Kirsty2020]. Observing the DNS to detect malicious use is widespread and effective too ✨. DNS over HTTPS has privacy benefits, but the way it's deployed right now can bypass these existing protective DNS measures 👀.

It was also noted that when everyone moves their jobs online, not understanding security becomes a much bigger problem 😬. Is it reasonable to expect every Internet user to get password training? Or is there a deeper problem with a technical solution? Modern advice is to use a layered approach to security defenses, and user education is just one of those layers 🧅.

Communication platforms like Zoom aren't new, and lots of people have used them for years 📹. But once COVID-19 pushed more organizations and individuals to these tools, they became an attractive target because usage went up. This led to more malicious cyber actor activity, like hijacking online meetings that weren't secured with passwords, or using unpatched software as an attack vector 🚪. So how can new or existing measures protect users from attacks aimed at the next vulnerable service? 🤔

Overall, there may have been fewer security challenges than expected when lots of people suddenly started working from home 🙌. But attacker agility, the importance of robust and scalable defense mechanisms, and some existing security problems and challenges may have become even more obvious and intense with more use of Internet-based services. This was especially true in a pandemic and in times of uncertainty, when users can be more vulnerable to social engineering techniques and attacks 💜.

3.2.5. Discussion 💬

There's a concern that we're missing observability for the network as a whole 👁️. Each application provider and operator has their own little lens, and nobody has the big-picture view of the network 🔍.

How much of a safety margin do we need? 🤷‍♀️ Some of the resiliency comes from not running the network too close to its limit. That leaves room for traffic to shift and gives the network headroom to cope 🌊. The best-effort nature of the network may help here. Running the network closer to its limits usually improves performance, but highly optimized networks may be less robust 🏎️.

Finally, it was observed that we get what we measure 📊. There may be an argument for operators to shift their measurement focus away from pure capacity and toward Quality of Experience (QoE) or resilience instead ✨. The Internet is critical infrastructure, and people are finally realizing that 🌍. We should treat this as a wake-up call to improve resilience, both in protocol design and operational practice, and not necessarily optimize for absolute performance or quality of experience 🫶.

3.3. Conclusions 🎀

There's a wealth of data about how the Internet performed during the COVID-19 crisis 📚. The main takeaway from the various measurements is that pretty large shifts happened 📈. And those shifts weren't just people swapping one app for another. They actually changed traffic flows and directions, and in many cases caused a significant traffic increase 🚀. Early reports also seem to show that the shifts went relatively smoothly from the point of view of overall consumer experience 😌.

An important but not-so-visible reason things ran smoothly is that many people and organizations were highly motivated to make sure the user experience stayed good 💪. A lot of collaboration happened behind the scenes, problems got fixed, many providers significantly increased their capacity, and so on 🛠️.

On the security front, COVID-19 showed how agile malicious actors can be when user Internet usage shifts, and how much potential disruption and damage they can cause 😱. It also showed how agile defenders can be when they have the tools and information they need to protect users and networks. It showcased the power of Indicators of Compromise when defenders around the world work together on the same problem 🤝.

In general, the Internet also seems well suited to adapting to new situations, at least within some bounds 🦋. The Internet is designed for flexibility and extensibility, rather than being optimized for today's particular traffic types. That makes it possible to use it for many applications and in many deployment situations, and to make changes as needed 🧩. This generality shows up in many parts of the overall system, from basic Internet technology to browsers, from name servers to content delivery networks and cloud platforms 🌐. When usage changes, what's usually needed is different services, maybe some reallocation of resources, and then continuing application of existing security defenses. Fundamental technology or hardware changes aren't needed 🙅‍♀️.

That said, it doesn't mean no improvements are needed 👇:

  • We need a better understanding of the health of the Internet 🩺. The critical role the Internet plays in our lives means its health needs to get significant attention going forward. Understanding how well networks work isn't just a technical matter. It's also crucially important to the people and economies of the societies using it. So projects and research that monitor Internet and service performance on a broad scale, across different networks, are important 📡.
  • We need to maintain defensive mechanisms for times of crisis 🛡️. Malicious cyber actors keep adjusting their tactics to take advantage of new situations, and the COVID-19 pandemic was no exception. Malicious actors used the strong appetite for COVID-19-related information as an opportunity to deliver malware and ransomware and to steal user credentials 😤. With the shift to working from home, more users vulnerable to attack, and IT departments often overwhelmed by rolling out new infrastructure and devices, sharing Indicators of Compromise (IoC) was a vital part of the response to COVID-19-related scams and attacks 🫡.
  • We need to ensure that broadband is available to all and that Internet services equally serve different groups 🌈. The pandemic showed how the effects of the digital divide can be amplified during a crisis, and it highlighted the importance of equitable Internet access 💖.
  • We need to keep working on all the other improvements that are seen as necessary anyway, like further security improvements and the ability for networks and applications to collaborate better 🔧.
  • We need to make sure informal collaboration between the different parties involved in operating the network continues, and gets stronger, to keep operational resilience going 🤗.

4. Feedback on Meeting Format 🖥️

While there are often virtual participants in IAB workshops, the IAB had no experience running workshops entirely virtually 🫣.

Feedback on this event format was largely positive though 🥰. It was especially useful that the three sessions were scheduled on Monday, Wednesday, and Friday. That meant the time in between could be used for mailing list discussion and for putting together additional workshop material 📝. The positive feedback was likely at least partly because many workshop participants already knew one another from previous face-to-face events, mostly IETF meetings 👯.

The process for sending invitations to the workshop should be improved for next time, though, because a few invitations were initially lost 📭. In a virtual meeting, it may make more sense to invite not just one person but all coauthors of a paper, for instance 💌. At least for this workshop, we didn't seem to suffer from having too many participants, and in many cases some participants may not be able to attend a particular session on certain days 🌸.

5. Position Papers 📚✨

Okay so these position papers came in, and they're listed in alphabetical order bc organization is everything 💅

  • Afanasyev, A., Wang, L., Yeh, E., Zhang, B., and Zhang, L.: Identifying the Disease from the Symptoms: Lessons for Networking in the COVID-19 Era [Afxanasyev2020]
  • Arkko, J.: Observations on Network User Behaviour During COVID-19 [Arkko2020]
  • Bronzino, F., Culley, E., Feamster, N., Liu, S., Livingood, J., and Schmitt, P.: IAB COVID-19 Workshop: Interconnection Changes in the United States [Bronzino2020]
  • Campling, A. and Lazanski, D.: Will the Internet Still Be Resilient During the Next Black Swan Event? [Campling2020]
  • Cho, K.: On the COVID-19 Impact to broadband traffic in Japan [Cho2020]
  • Clark, D.: Measurement of congestion on ISP interconnection links [Clark2020]
  • Favale, T., Soro, F., Trevisan, M., Drago, I., and Mellia, M.: Campus traffic and e-Learning during COVID-19 pandemic [Favale2020]
  • Feldmann, A., Gasser, O., Lichtblau, F., Pujol, E., Poese, I., Dietzel, C., Wagner, D., Wichtlhuber, M., Tapiador, J., Vallina-Rodriguez, N., Hohlfeld, O., and Smaragdakis, G.: A view of Internet Traffic Shifts at ISP and IXPs during the COVID-19 Pandemic [Feldmann2020]
  • Fontugne, R., Shah, A., and Cho, K.: The Impact of COVID-19 on Last-mile Latency [Fontugne2020]
  • Gillmor, D.: Vaccines, Privacy, Software Updates, and Trust [Gillmor2020]
  • Gu, Y. and Li, Z.: Covid 19 Impact on China ISP's Network Traffic Pattern and Solution Discussion [Gu2020]
  • Jennings, C. and Kozanian, P.: WebEx Scaling During Covid [Jennings2020]
  • Lutu, A., Perino, D., Bagnulo, M., Frias-Martinez, E., and Khangosstar, J.: A Characterization of the COVID-19 Pandemic Impact on a Mobile Network Operator Traffic [Lutu2020]
  • Mok, R., and claffy, kc: Measuring the impact of COVID-19 on cloud network performance [Mok2020]
  • Paine, K.: IAB COVID-19 Network Impacts [Kirsty2020]

6. Program Committee 🎀

The workshop program committee squad was Jari Arkko, Stephen Farrell, Cullen Jennings, Colin Perkins, Ben Campbell, and Mirja Kühlewind. Main character lineup 👑

7. Informative References 🧚

Here's the whole reference stash, all in one place 🍓

Appendix A. Workshop Participants 🌸

Here's the alphabetical roll call of everyone who showed up to the workshop 🦋

  • Jari Arkko (Ericsson/IAB)
  • Ben Campbell (Independent/IAB)
  • Andrew Campling (419 Consulting)
  • Kenjiro Cho (IIJ)
  • kc claffy (CAIDA)
  • David Clark (MIT CSAIL)
  • Chris Dietzel (DE-CIX)
  • Idilio Drago (University of Turin)
  • Stephen Farrell (Trinity College Dublin/IAB)
  • Nick Feamster (University of Chicago)
  • Anja Feldmann (Max Planck Institute for Informatics)
  • Romain Fontugne (IIJ Research Lab)
  • Oliver Gasser (Max Planck Institute for Informatics)
  • Daniel Kahn Gillmor (ACLU)
  • Yunan Gu (Huawei)
  • Oliver Hohlfeld (Brandenburg University of Technology (BTU))
  • Jana Iyengar (Fastly)
  • Cullen Jennings (Cisco/IAB)
  • Mirja Kühlewind (Ericsson/IAB)
  • Dominique Lazanski
  • Zhenbin Li (Huawei/IAB)
  • Franziska Lichtblau (Max Planck Institute for Informatics)
  • Jason Livingood (Comcast)
  • Andra Lutu (Telefonica Research)
  • Vesna Manojlovic (RIPE NCC)
  • Rüdiger Martin (EC)
  • Larry Masinter (Retired)
  • Matt Matthis (Google)
  • Jared Mauch (Akamai/IAB)
  • Deep Medhi (NSF)
  • Marco Mellia (Politecnico di Torino)
  • Ricky Mok (CAIDA)
  • Karen O'Donoghue (Internet Society)
  • Kirsty Paine (NCSC)
  • Diego Perino (Telefonica Research)
  • Colin Perkins (University of Glasgow/IRTF/IAB)
  • Enric Pujol (Benocs)
  • Anant Shah (Verizon Media Platform)
  • Francesca Soro (Politecnico di Torino)
  • Brian Trammell (Google)
  • Martino Trevisan
  • Georgios Tselentis (European Commission)
  • Lan Wang (University of Memphis)
  • Rob Wilton (Cisco)
  • Jiankang Yao (CNNIC)
  • Lixia Zhang (UCLA)

IAB Members at the Time of Approval 👑

These were the Internet Architecture Board members when this document got approved for publication 💖

  • Jari Arkko
  • Deborah Brungard
  • Ben Campbell
  • Lars Eggert
  • Wes Hardaker
  • Cullen Jennings
  • Mirja Kühlewind
  • Zhenbin Li
  • Jared Mauch
  • Tommy Pauly
  • David Schinazi
  • Russ White
  • Jiankang Yao

Acknowledgments 🫶

The authors want to thank the workshop participants, the members of the IAB, the program committee, the folks on the architecture discussion list for the interesting conversations, and Cindy Morgan for handling the practical arrangements. 💜

Extra special thanks go to the participants who also contributed to this report. Romain Fontugne provided text based on his blog post at https://eng-blog.iij.ad.jp/archives/7722. Ricky Mok wrote text on cloud platforms. Martino Trevisan wrote text on campus networks. David Clark covered congestion measurements at interconnects. Oliver Hohlfeld wrote the text on traffic growth, changes in traffic shifts, campus networks, and interconnections. Andra Lutu handled mobile networks. Kirsty Paine wrote text on security impacts. And Jason Livingood gets a huge thank you for his review and additions 🌈

Authors' Addresses 💌

  • Jari Arkko, Ericsson, Email: jari.arkko@ericsson.com
  • Stephen Farrell, Trinity College Dublin, Email: stephen.farrell@cs.tcd.ie
  • Mirja Kühlewind, Ericsson, Email: mirja.kuehlewind@ericsson.com
  • Colin Perkins, University of Glasgow, Email: csp@csperkins.org
📦 where this page comes from