A Decade Long View of Internet Traffic Composition in Japan

The Internet traffic composition has changed considerably over the last decade and continues to evolve as a consequence of several factors. In this paper, we showcase this change taking a holistic view derived from the deployment of new and emerging protocols (QUIC, encrypted DNS), shifting user behavior towards a (more) secure Web, natural incidents (Covid-19 pandemic), and effects of peering with large content delivery hyper-giants (Google) that tend to have both short- and long-lasting impact on Internet traffic. Knowledge of such changing trends is essential for better management of networks and services. To this end, we analyze >6.6 TiB of data collected at a large backbone link in Japan (MAWI dataset) and investigate traffic composition across several months and years. We observe that IPv6 traffic in 2019 represents a volume comparable to that of the total traffic observed in 2007 and is (now) increasingly used to carry Web traffic. Over IPv4, we observe significant growth in encrypted Web traffic with HTTPS-to-HTTP ratio evolving to 2-to-1 in 2019 compared to less than 2% HTTPS share in 2007. Meanwhile, we witness (for the first time) an alteration of the traffic composition on the educational network as a result of the Covid-19 pandemic. We observe a vanishing weekday-weekend pattern and a shift towards increased usage of OpenVPN and rsync traffic due to increased remote work. Finally, we also study the impact of Google as a peering entity in the routing ecosystem and observe a significantly increased traffic share of QUIC over both address families, and overall a larger HTTP-to-HTTPS ratio in terms of traffic volume.