At NANOG 79 earlier this month, Nokia Deepfield’s Craig Labowitz presented on the impact of the COVID-19 pandemic on Internet use in 2020.

The approach to the analysis used real-time streaming telemetry from the Communication Service Providers (CSP) backbone and aggregation routers, and covered content provider networks in North America, Europe and parts of Asia.

Craig reported a major level of traffic growth in affected regions, and increased use of various video streaming services and Zoom. Peak traffic volumes appear to be 30 to 50% higher in March 2020. Video streaming volumes rose earlier in the evening, and peak hour weekend traffic in March was 45% higher than pre-pandemic levels.

This should not be surprising, of course. Many economies enacted various social distancing and stay-at-home measures that forced businesses, schools and universities to shut down their offices and classrooms. Daily commutes for many workers and students became a trip to the keyboard, and many forms of social contact were now mediated by WhatsApp, Zoom and Skype instead of face-to-face.

A similar story was evident using a study of DNS resolver patterns by InternetNZ’s Sebastián Castro at the recent DNS OARC 32a workshop. The lockdown in New Zealand saw increased DNS activity, and various events, such as daily broadcasts on the state of the pandemic, could be mapped to DNS traffic activity.

Work versus Home

Over the past couple of decades, we’ve actually constructed two quite distinct online environments in the Internet.

There is the ‘enterprise’ network, which is commonly encountered at the physical workplace, and there is the ‘consumer’ network, which has been deployed across residential infrastructure. Each has many observable characteristics/patterns and differences, particularly during work hours and evenings, as well as weekdays and weekends.

For example, Figure 1 shows the total level of capability for IPv6 in the first half of 2019 for the entire Internet.

Figure 1: Use of IPv6 (Jan-Jun 2019)

There is a distinct weekday pattern in the data where weekend use shows some 2% more overall use of IPv6 than weekday use. We can assume that enterprise network environments do not support IPv6 to the same extent as consumer network environments.

What about the DNS? Are there differences in enterprise use of DNS resolvers that are different from consumer use?

Figure 2 shows the level of daily use of four open DNS resolvers in the latter part of 2019.

Figure 2: Use of Open DNS resolvers (Jun-Dec 2019)

Google’s service (the red line) shows a clear weekday/weekend difference. Google use is higher by 1-2% on weekdays over weekends.

A similar pattern is evident in 114DNS, a Chinese operated open resolver (green line) and OpenDNS (orange line). The record for Cloudflare (blue line) is not so clear at this scale but there is also evidence of a weekday/weekend use difference.

By using APNIC’s measurement platform we can see clear differences in IPv6 use and the use of open DNS resolvers between enterprise and consumer network environments.

When the office workforce was sent home to work did they take a VPN configuration with them that exactly replicated the enterprise environment? Or were they using the consumer network for their work? The answer is likely mixed.

Some enterprise configurations include strict security requirements that replicate the enterprise environment in the home configuration and they probably rely on VPN tools to isolate the end device from the home environment. But other enterprises’ networks may not be so restrictive and working from home may well include using the services from the home provider network. In addition to this, there is the migration of mobile devices, always going where the owner goes, which in the home tends to latch on to local Wi-Fi whereas in the work environment, might use either the enterprise network or the cellular data network.

To illustrate, let’s look at the DNS resolver use profile of one of the largest retail consumer ISPs in the United States, Comcast. Figure 3 shows the use of DNS resolvers by users of Comcast’s network, AS7922 from December 2019 until early June 2020.

Figure 3: Use of Comcast’s DNS resolver (Dec 2019 – Jun 2020)

The blue line shows that on weekends, some 82% of Comcast users use Comcast’s DNS resolvers, but this drops to 77% on weekdays. Much of this DNS query load is reflected in the use of Google’s public DNS service, where the use of Google’s service is 3-4% higher on weekdays as compared to weekends.

The second half of December shows a change in the weekly pattern associated with the holiday period. It’s also clear that the DNS resolver’s pattern of use changed on Monday, 16 March for Comcast’s users. The relative use of Google’s service dropped and flattened across the week, and the use of Comcast’s DNS services similarly flattened across each week for the last two weeks in March and through April.

Signs of the US workforce heading back to the office are evident in May, and in the first week of June, the weekday use profile is much closer to that seen before the pandemic.

An economy-by-economy profile of working from home

Using this approach, we can look at the DNS and IPv6 use profiles of several economies and see the effects of the pandemic lockdown.

Let’s start with China (Figure 4), where we can see a very drastic change in mid-late January.

Figure 4: China’s DNS resolver profile (Jul 2019-Jun 2020)

Chinese New Year fell on 25 January 2020 and was followed by a progressive lockdown across China. The pre-pandemic use profile largely reappeared in April 2020, although the consumer use profile is slightly different from that of December 2019, so it may be that there is still some component of working from home in China.

In Europe, different economies have seen very different levels of intensity in the disease outbreak, but most had similar reactions, with the implementation of various levels of working from home.

In Germany, the change in behaviour is noticeable starting in mid-March, with an increase in the use of in-network resolvers with a loss of traffic to public DNS resolvers, of which Google is the biggest (Figure 5).

Figure 5: Germany’s DNS resolver profile (Jan-Jun 2020)

It is also quite apparent how reopening started in the first half of May. Observed behaviour shows that a significant amount of Google public DNS traffic originates in business networks.

France shows an even more marked effect (disregard the three spikes that are due to measurement artefacts) and an almost complete return to normality by June (Figure 6).

Figure 6: France’s DNS resolver profile (Jan-Jun 2020)

In the UK, the effects are seen a bit later than in other European economies and the observed changes are mostly to do with the disappearance of the normal weekly pattern in all DNS traffic at the end of March (Figure 7). This remains the case until early June.

Figure 7: The United Kingdom’s DNS resolver profile (Jan-Jun 2020)

Similar behaviour is observed in Italy (Figure 8) but with the migration of Google Public traffic to other in-country resolvers (this might signal the launch of a new Google PDNS node in Italy for which the IP addresses are not yet reflected in Google’s publication resources).

Figure 8: Italy’s DNS profile (Jan-May 2020)

Some economies did not, for their own reasons, implement lockdowns. Below we can see the graphs for Sweden, Brasil and Russia.

Sweden (Figure 9) shows a massive shift in DNS resolver location in late February, unrelated to COVID-19 (Telia moved blocks of IPv4 addresses from their ISP network to their corporate network, but not the IPv6 blocks, splitting the traffic equally between their two networks).

Figure 9: Sweden’s DNS profile (Jan-Jun 2020)

Otherwise, the three economies show the same patterns throughout the whole of 2020 so far, with little evidence of a weekly use pattern that has been disrupted by the pandemic.

Figure 10: Brazil’s DNS profile (Jan-Jun 2020). It shows a steady increase of use of Google’s public DNS service and Cloudflare’s open DNS.

Figure 11: Russia’s DNS profile (Jan-Jun 2020)

And finally, let’s look at New Zealand (Figure 12). Orders to work from home started 23 March but changes in behaviour become apparent in mid-February. The weekly distribution of the use of resolvers altered, notably, in a rapid decline in the use of Google’s DNS service.

Figure 12: New Zealand’s DNS profile (Jan-Jun 2020)

At the same time use of non-local New Zealand resolvers increased. By the start of June, it appears that use patters have largely been restored and large-scale work from home is over.

What changes were observed in IPv6 and DNSSEC?

One evident casualty of the pandemic is the continued deployment of IPv6.

We ended 2019 with a 24% (weekday) – 26% (weekend) IPv6 use profile, which was an increase of 5% over the 12 months of 2019. By June the numbers are just 1% higher than the figures at the start of the year (Figure 13).

Figure 13: Global IPv6 use (2019–2020)

By the start of June, most parts of the networking world appear to be settling back into the old normal, but it may take a few more months to restore the complete environment.

IPv6 use has been falling for the past six weeks, and it may have to wait for the end of the northern hemisphere summer to see the resumption of IPv6 deployment activity.

A similar picture of a temporary pause in the expansion of deployment also appears to apply to DNSSEC validation too (Figure 14).

Figure 14: DNSSEC validation deployment

Back to (the new) normal

So, the pandemic may not be over, and we may yet have to experience further waves of infection in the coming months, but it certainly appears that working from home is largely over for most parts of the world.

We seem to be back to the usual weekday/weekend profiles of use for the DNS and heading in that direction for IPv6.

This article was originally posted on the APNIC blog.