Flavio Luciani

When Internet Traffic Becomes a Physical Event

Author image
Flavio Luciani(community contributor)

8 min read

0
Article lead image

Why do live sports, ticket sales, and public service launches sometimes resemble DDoS attacks? This article explores how synchronised user behaviour turns Internet traffic into a physical phenomenon that places real pressure on network infrastructure.


For years, we have described the Internet as something immaterial. The very language of digital technology has always evoked lightness: cloud, virtualisation, distributed services, and therefore abstraction. Everything seems far removed from the concreteness of the physical world. Yet there are moments when the network suddenly stops appearing abstract and reveals its material nature.

This happens when traffic concentrates, accelerates, or collides with the limits of infrastructures. It happens during click days, but also during major sports finals streamed online, the release of a highly anticipated TV series, concert presales, or other major digital events capable of synchronising thousands of people at the same instant.

Precisely for this reason, the case described by Luca Cicchelli in his LinkedIn post on "unintentional and officialised DDoS" is interesting, regarding the problems that accompanied the opening of applications for a voucher introduced by the Piedmont Region in Italy to support families with children in the 0–6 age range. Not because it represents a particularly sophisticated technical anomaly, but because it makes evident something we often tend to overlook: Internet traffic is not only a logical phenomenon. It is also a physical phenomenon.

Collective behaviour

For years, observing the traffic that crosses interconnection infrastructures has made it clear how the collective behaviour of users can turn into a phenomenon measurable almost like a physical quantity. As CTO of Namex, I often happen to observe sudden peaks that do not originate from malicious attacks, but from perfectly legitimate events: public platforms opening simultaneous procedures, sports events in streaming, ticketing platforms, financial services, or applications that concentrate thousands of users at the same instant.

From the network’s point of view, these phenomena have very recognisable signatures. Traffic curves change shape within a few seconds. Latency and retransmission increase simultaneously. Flows become extremely concentrated on specific network operators, content distribution systems, or cloud platforms. In some cases, actual waves of congestion can be observed propagating through different layers of the infrastructure, from application systems all the way to interconnection points.

It is interesting to note how these phenomena resemble urban or energy dynamics much more than the classic model of Internet browsing distributed over time. Under normal conditions, traffic follows a relatively predictable, almost organic pattern. During major digital events, however, thousands of users suddenly synchronise. The network stops behaving like a set of independent connections and takes on the characteristics of a coordinated mass.

When thousands of people try to access the same service at the same time, the infrastructure progressively comes under pressure. Platforms slow down, waiting times increase, and every new access attempt contributes to further fuelling congestion. It is a dynamic very similar to what we observe in urban crowds, road traffic, or power grids during moments of peak consumption.

The difference is that here the crowd does not occupy squares or railway stations. It occupies CPUs, TCP sockets, databases, caches, network bandwidth. Every click exerts a force. Every refresh increases the pressure. Every user contributes to a digital mass that, at a certain point, stops being merely a statistic and becomes collective dynamics. And this is precisely the most interesting nature of major synchronised digital events: they can produce the same systemic effects as a DDoS attack, but without attackers. In a traditional DDoS, there is malicious intent. In these cases, instead, users are simply trying to legitimately access content or a service. From the infrastructure’s point of view, however, much less changes than one might think. The network does not interpret human intentions. It sees only volumes, simultaneity, congestion.

Observing Internet traffic on a large scale, there is a particularly interesting detail: very often, the collapse does not occur in the main network. Today’s major Internet backbones have enormous capacity. Instead, critical issues emerge at traffic concentration points, where millions of simultaneous requests end up being compressed onto the same systems, generating slowdowns and congestion. It is exactly what also happens in physical infrastructures: the problem is rarely the highway as a whole, but the junctions, access points, and places where flows suddenly concentrate.

In other words, traffic does not “break the Internet.” Instead, it compresses the system’s areas of density, exactly as happens in the physical infrastructures of cities. This too is profoundly material behaviour.

The illusion of infinite infrastructure

In recent years, the cloud has fuelled the illusion of infinite infrastructure. Autoscaling, containerisation, distributed orchestration, and elastic platforms have spread the idea that every load problem can be solved by adding resources. But every real system continues to have physical limits. There are throughput thresholds, finite I/O capacities, incompressible latencies, database bottlenecks, energy limits, network saturation.

Behind every HTTP request there is always matter: transistors, memory, optical equipment, electrical energy, thermal dissipation, data centres. Digital traffic may be invisible to the eye, but it produces absolutely concrete effects. It consumes energy, generates heat, creates congestion, introduces friction. The modern network is not immaterial: it is a gigantic physical infrastructure distributed on a planetary scale.

But perhaps the most important point is another. Often, after a major digital event that generates slowdowns or congestion, the debate focuses exclusively on the technical resilience of the systems. People talk about insufficient servers, poorly designed platforms, inadequate scalability. All correct, but incomplete. Because the real problem arises much earlier than the infrastructure: it arises from the model with which we organise access to digital services.

Synchronisation is the real bottleneck

Many online events artificially introduce simultaneity. They transform users distributed over time into a mass synchronised on the same instant. It is a dynamic that inevitably generates traffic concentration. In practice, we build experiences based on urgency, immediate access, or simultaneous participation, and then we are surprised when collective behaviour produces saturation.

If the same people accessed at different times, the system would probably hold up without any particular difficulty. It is temporal concentration that turns traffic into a critical event. It is not the absolute volume of users that produces the collapse, but the sudden synchronisation of actions.

In this sense, these phenomena tell us something much broader about the functioning of the contemporary network. The Internet is no longer only a communication infrastructure. It has become a space of synchronised collective behaviour.

Live events and measurable traffic

We see this clearly in the live streaming of global sports events. During football finals, the Olympics, or major international competitions, millions of people try to access the same video content simultaneously, at the exact same instant. From the point of view of traffic, it is an extremely particular phenomenon: there is no temporal distribution of demand. Everyone enters together, everyone requests the same streams, everyone generates the same concentration of traffic toward CDNs, edge caches, and OTT platforms.

In these cases, traffic takes on almost impulsive characteristics. In the minutes immediately preceding the start of the event, very rapid increases in throughput, an increase in concurrent sessions, and very high pressure on video distribution systems can be observed. A delay of just a few seconds in cache propagation or application scalability is enough to generate buffering, degradation of video quality, or local saturation.

NOTE: This chart shows the traffic observed at Namex during a UEFA Champions League match streamed exclusively by Amazon Prime Video. In just a few minutes, traffic reached approximately 1.47 Tbps, highlighting how major live events are capable of synchronising millions of users simultaneously and transforming collective behaviour into a physical phenomenon measurable on the network.

And it is interesting to observe how user behaviour further amplifies the phenomenon. When a stream slows down, thousands of people refresh the page simultaneously or change video quality at the same moment. The system thus enters a sort of collective feedback loop in which users’ reactions further increase the load.

Video-on-demand platforms also show very similar dynamics. When a particularly anticipated TV series is released globally, traffic does not distribute randomly throughout the day. It concentrates immediately after the announcement or at the exact release time. From a technical point of view, it is not identical to pure live streaming, because the content is static and can be distributed more easily through geographic caches and CDNs. However, the collective behaviour of users produces very similar effects: simultaneous authentication peaks, massive requests toward the same video assets, pressure on recommendation platforms, login systems, and application APIs. In practice, the type of synchronisation changes, but not the physical nature of the event. In live streaming, simultaneity is absolute because everyone watches the same content at the same moment. In video on demand, simultaneity is social and cultural: millions of people decide to access simultaneously because they share the same collective expectation.

The same behaviour emerges in concert presales, product launches, breaking news, and global trends that channel millions of people into the same virtual place at the same moment.

Crowds, not just users

Today, the network does not simply transport data. It transports collective impulses, shared urgencies, emotional synchronisations. And when millions of individuals act simultaneously, the digital stops being abstract. It becomes pressure, density, and congestion. It becomes physics.

Perhaps the time has come to stop thinking of users as simple numbers inside dashboards and monitoring charts. In major digital events, users become a crowd. And every crowd, inevitably, exerts pressure on the space it moves through, even when that space is made of networks, servers, and data packets.

0

You may also like

View more

About the author

Author image

Flavio Luciani was born in Rome in 1981 and graduated in Computer Engineering from the University of Roma Tre in 2005. Since 2008 he has been in the team of Namex, the Internet eXchange Point in Rome, first as a member of the technical staff and since 2020 as Chief Technology Officer. He is currently involved in several initiatives in the Internet Community: he collaborates with the RIPE NCC organisation, with the association of European eXchange points EURO-IX and holds a role in the Steering Committee, within the Internet Society (ISOC) initiative, Mutually Agreed Norms for Routing Security. Through workshops, courses and in-depth articles, it promotes greater attention to the topic of routing security.

Comments 0