Anatomy of an OTT traffic surge: 2022 Men's NCAA Basketball Championship

Last night, Kansas topped the University of North Carolina in a thrilling come-from-behind victory to win their fourth championship in men’s college basketball. It was also notable in how viewers saw the game. Instead of being aired on CBS (network television), the game was carried on TBS requiring viewers to have either a cable TV package or use a streaming service to watch the game. Here’s what we saw.

OTT Service Tracking

Kentik’s OTT Service Tracking (part of Kentik Service Provider Analytics) combines DNS queries with NetFlow to allow a user to understand exactly how OTT services are being delivered — an invaluable capability when trying to determine what is responsible for the latest traffic surge. Whether it is a Call of Duty update or a Microsoft Patch Tuesday, these OTT traffic events can put a lot of load on a network and understanding them is necessary to keep a network operating at an optimal level.

The capability is more than simple NetFlow analysis. Knowing the source and destination IPs of the NetFlow of a traffic surge isn’t enough to decompose a networking incident into the specific OTT services, ports, and CDNs involved. DNS query data is necessary to associate NetFlow traffic statistics with specific OTT services in order to answer questions such as, “What specific OTT service is causing my peering link with a certain CDN to become saturated?”

Kentik True Origin is the engine that powers OTT Service Tracking workflow. True Origin detects and analyzes the DNA of over 540 categorized OTT services and providers and more than 50 CDNs in real time, all without the need to deploy DPI (deep packet inspection) appliances behind every port at the edge of the network.

Kansas tops UNC in a thriller

Many viewers watched last night’s men’s championship game using one of several OTT streaming services. One of the more popular options, based on Kentik data, was Sling TV.

As illustrated below in a screenshot from Kentik’s Data Explorer view, traffic to Sling TV surged as hoops fans used the streaming service to watch the game. As soon as it ended, traffic dropped precipitously and viewers signed off before heading to bed. There was even a little dip during halftime. Fastly and Akamai were the top CDN’s handling delivery of Sling TV’s traffic to users.

When broken down by Connectivity Type, Kentik customers delivered the basketball game on Sling TV to their subscribers from a variety of sources including transit (45.4%), private peering (39.4%), embedded cache (14.2%), and IXP (0.9%). Usually, CDNs with a last mile cache embedding program heavily favor these against other connectivity types as it both allows:

• The ISP to save transit costs
• The subscribers to get demonstrably better last-mile performance

In this case, the fact that embedded cache traffic is a small proportion of the overall delivery implies that some ISPs from this dataset have maxed-out their embedded caches.

In addition to source CDN and connectivity type, users of Kentik’s OTT Service Tracking are also able to break down traffic volumes by subscribers, specific router interfaces and customer locations.

How does OTT Service Tracking help?

In July, my colleague Greg Villain described the latest enhancements to our OTT Service Tracking workflow which allows providers to plan and execute what matters to their subscribers, including:

• Maintaining competitive costs
• Anticipating and fixing subscriber OTT service performance issues
• Delivering sufficient inbound capacity to ensure resilience

Major traffic events like the release of a blockbuster movie on streaming can have impacts in all three areas. OTT Service Tracking is the key to understanding and responding when they occur. Learn more about the application of Kentik for network business analytics here.

Ready to improve over-the-top service tracking for your own networks? Start a free trial of Kentik today.