Kentik - Network Observability
Back to Blog

Black Friday vs. Cyber Monday: Traffic Insights from Kentik

Justin Ryburn
Justin RyburnField CTO

Network Engineering


Media reports tell us that Cyber Monday marked a single-day record for revenue from online shopping. We can assume that those sales correlated with a general spike in network utilization, but from a management and planning perspective we might want to go deeper, exploring the when and where of traffic patterns to specific sites. In this post we use Kentik Detect to see what can be learned from a deeper dive into holiday traffic.

Comparing Online Holiday Sales With Network Traffic

Unless last week’s Thanksgiving turkey still has you in a snooze, you likely heard some of the recent buzz about Black Friday and Cyber Monday. Kicking off the holiday shopping season, Black Friday deals brought in $5.03 billion last week, while Cyber Monday officially became (according to Adobe) “the largest U.S. online shopping day ever,” hitting a new record of $6.59 billion in a single day.

At Kentik, we recognized immediately that our ability to see deep into network traffic could yield valuable insights not simply into these shopping events themselves but into any business scenario in which network traffic can be correlated with revenue. So we wanted to investigate how the sales figures matched up with traffic to the sites doing the selling. To see that we turned to the Data Explorer section of Kentik Detect, which is designed for ad hoc querying of traffic data including flow records (NetFlow, sFlow, etc.), BGP, GeoIP, and NPM metrics. With the permission and help of a few of our customers, we took a look at traffic patterns from both residential and commercial networks to some of the largest retailers promoting the biggest holiday sales, namely Amazon, Walmart, and Target.

Walmart: Being Prepared

Based on an article in the Wall Street Journal earlier this week, we know that Walmart prepared for an influx of network traffic associated with its holiday deals by redesigning data centers and leveraging analytics. As Walmart’s CTO told the Journal, “We’ll be standing there in the network operations center, hoping for a boring technology week.”


One indication of how Walmart hoped to keep things uneventful comes from applying our analytics to traffic across the networks of some of our customers (each of whom opted-in for us to look at the data). Kentik Detect’s ability to filter on destination AS (shown at right) enabled us to look at traffic headed toward Walmart’s infrastructure. As shown in the graph below, there’s a noticeable drop in traffic at approximately midnight on November 18 — one week prior to Black Friday. Did Walmart prepare for the holiday rush by shifting some traffic away from their own infrastructure to resources in the public cloud?


Zooming in on the Thanksgiving weekend, we found two other interesting observations:

  • Normally there’s a big dip in traffic overnight, but that dip was quite minor on “Thanksgiving Eve” (Wednesday, November 22). We think that’s because Walmart launched all of their online deals that evening at midnight.
  • Walmart’s network traffic volume appears to be in line with the overall sales results reported by Adobe: Cyber Monday was bigger than Black Friday.

Target’s Black Friday vs. Cyber Monday

Another large online retailer we looked at — this time via a large residential broadband provider — was The provider has instrumented all of their DNS resolvers with Kentik’s kprobe host agent, which lets them examine the application-layer details of all DNS requests from their subscribers. Using that data, we looked at DNS query volume (for and to get a picture of how often this provider’s customers were visiting the Target website.

An interesting observation popped up from that graph. Contrary to what we saw with Walmart, Target had about 4x greater traffic volume on Black Friday compared to what was observed on Cyber Monday.


Amazon’s Black Friday vs. Cyber Monday

We also looked at DNS query volume toward Amazon, using DNS to distinguish traffic toward vs. the rest of AWS. And once again we noticed a couple of interesting things about the Amazon traffic:

  • Compared to the week-before volume (shown as a dashed gray line), traffic volume in general was elevated starting on Thanksgiving Day. No surprise there.
  • And as with Target, traffic on Black Friday had higher overall volume and a higher peak than traffic on Cyber Monday.

Devices Down for Dinner

With all the emphasis on shopping it’s easy to forget that Thanksgiving is supposed to be about being grateful and gathering as a family. There’s some good news on that front. Our analysis shows that as people came to the dinner table on Thanksgiving, fewer of them appeared to be shopping or using their devices. You can see the dinner-time dip on the multi-day graph above, but below is a zoomed-in view of Thanksgiving Day only, with times shown in Pacific Standard Time (GMT -8).



The value of being able to make observations like these stretches far beyond retailers and the consumers who shop with them. For anyone whose business depends on an online presence, pervasive visibility is critical because network traffic translates directly into revenue. Imagine if the Level 3 route leak had occurred on Black Friday or Cyber Monday. Based on the sales numbers that retailers saw this shopping season — over $11.5 billion in just two days — a network outage could have cost millions of dollars per minute.

Understanding the details of network traffic, in real-time, and accelerating a resolution for any observed issues can have a huge impact on the bottom line. To learn how to harness the power of Kentik Detect to protect your online revenue stream, request a demo or sign up for a free trial today.

We use cookies to deliver our services.
By using our website, you agree to the use of cookies as described in our Privacy Policy.