1. Periodic Observation Report

Broadband Traffic Report:
Moderate Growth in Traffic Volume Ongoing
1.1 Overview

here. As of June 2019, IPoE accounted for 19% of IN and

In this report, we analyze traffic over the broadband ac-

14% of OUT broadband traffic overall. Respectively, thesecess services operated by IIJ and present the results eachare year-on-year increases of 7 and 6 points, so use of IPoE

yearr*1*2*3*4*5*6*7*8*9*10. Here, we again report on changes in

is rising.

traffic trends over the past year, based on daily user traffic
and usage by port.

Growth in both broadband and mobile traffic has risen, withsome ups and downs, over the past two years or so. These

Figure 1 shows the overall average monthly traffic trends forfluctuations in broadband and mobile have been mostly syn-

IIJ’s fixed broadband services and mobile services. IN/OUT

chronous with each other, suggesting that the underlying

indicates the direction from the ISP perspective. IN represents

factors are the same.

uploads from users, and OUT represents user downloads.
Because we cannot disclose specific traffic numbers, weOver the past year, broadband IN traffic increased 12% andhave normalized the data, setting the latest OUT observation

broadband OUT traffic increased 19%, virtually the samein each dataset to 1.

growth rates as the year-earlier figures of 12% and 20%.
Growth in mobile traffic has slowed, IN from 69% a year ear-Since the previous edition of this report, the broadband datalier to 60% this year, and OUT from 36% to 22%. And thehave included IPv6 IPoE traffic. The thin line labeled “broad-

total volume of mobile traffic remains an order of magnitude

band-IPoE” excludes IPv6 IPoE traffic. IPv6 traffic on IIJ’s

lower than broadband traffic.

broadband services comprises both IPoE and PPPoE traffic,*11

but IPoE traffic does not pass directly through IIJ’s network

1.2 About the Dataas we use Internet Multifeed Co.’s transix service for IPoE,

As with previous reports, for broadband traffic, our analysis

and IPoE is therefore excluded from the analysis that follows

uses data sampled using Sampled NetFlow from the routers that accommodate the fiber-optic and DSL broadband

1.0

Traffic Volume

0.8

customers of our personal and enterprise broadband accessIN（broadband）
OUT（broadband）
IN（broadband-IPoE）
OUT（broadband-IPoE）
IN（mobile）
OUT（mobile）

services. For mobile traffic, we use access gateway billinginformation to determine usage volumes for personal andenterprise mobile services, and we use Sampled NetFlow
data from the routers used to accommodate these services

0.6

to determine the ports used.

0.4

Because traffic trends differ between weekdays and weekends, we analyze traffic in one-week chunks. In this report,

0.2

we look at data for the week of May 27 through June 2,
2019, and compare those data with data for the week of

0
2008

2010

2012

2014

2016

2018

Month/YearMay 28 through June 3, 2018, which we analyzed in theprevious edition of this report.

Figure 1: Monthly Broadband and Mobile Traffic over Time

4

*1

Kenjiro Cho. Broadband Traffic Report: Download Growth Slows for a Second Year Running. Vol.40. pp4-9. September 2018.

*2

Kenjiro Cho. Broadband Traffic Report: Traffic Growth Slows to a Degree. Internet Infrastructure Review. Vol.36. pp4-9. September 2017.

*3

Kenjiro Cho. Broadband Traffic Report: Traffic Growth is Accelerating. Internet Infrastructure Review. Vol.32. pp28-33. August 2016.

*4

Kenjiro Cho. Broadband Traffic Report: Comparing Broadband and Mobile Traffic. Internet Infrastructure Review. Vol.28. pp28-33. August 2015.

*5

Kenjiro Cho. Broadband Traffic Report: Traffic Volumes Rise Steadily Over the Past Year, and HTTPS Use Expands. Internet Infrastructure Review. Vol.24. pp28-33. August 2014.

*6

Kenjiro Cho. Broadband Traffic Report: The Impact of Criminalization of Illegal Downloads was Limited. Internet Infrastructure Review. Vol.20. pp32-37. August 2013.

*7

Kenjiro Cho. Broadband Traffic Report: Traffic Trends over the Past Year. Internet Infrastructure Review. Vol.16. pp33-37. August 2012.

*8

Kenjiro Cho. Broadband Traffic Report: Examining the Impact of the Earthquake on Traffic on a Macro Level. Internet Infrastructure Review. Vol.12. pp25-30. August 2011.

*9Kenjiro Cho. Broadband Traffic Report: Traffic Shifting away from P2P File Sharing to Web Services. Vol.8. pp25-30. August 2010.

*10

Kenjiro Cho. Broadband Traffic Report: Increasing Traffic for General Users. Internet Infrastructure Review. Vol.4. pp18-23. August 2009.

*11

Akimichi Ogawa. Appendix A.3 “IPv6 PPPoE and IPv6 IPoE” in Professional IPv6 (in Japanese). Lambda Note. July 2018.

© Internet Initiative Japan Inc.

Nov.2019

Vol.

44

1. Periodic Observation Report

Results are aggregated by subscription for broadband

interpretable conclusions. Note that because of the difficulty

traffic, and by phone number for mobile traffic as some sub-of distinguishing between individual and enterprise usage,

scriptions cover multiple phone numbers. The usage volume

the analysis of usage by port in the next section does in-for each broadband user was obtained by matching the IP

clude enterprise data.

address assigned to users with the IP addresses observed.
We gathered statistical information by sampling packets

Figure 2 and Figure 3 show the average daily usage dis-using NetFlow. Sampling rates were set between 1/8,192

tributions (probability density functions) for broadband andand 1/16,382, taking into account router performance andmobile users. Each compares data for 2018 and 2019 split

load. We estimated overall usage volumes by multiplying

into IN (upload) and OUT (download), with user traffic vol-observed volumes with the reciprocal of the sampling rate.

ume plotted along the X-axis and user frequency along the
Y-axis. The X-axis shows volumes between 10KB (104)

IIJ provides both fiber-optic and DSL broadband services,and 100GB (1011) using a logarithmic scale. Most users

but fiber-optic access now accounts for the vast majority offall within the 100GB (1011) range, with a few exceptions.

use. Of users observed in 2019, 98% were using fiber-optic
connections and accounted for 99% of overall broadband

The IN and OUT broadband traffic distributions are close

traffic volume.

to a log-normal distribution, which looks like a normal distribution on a semi-log plot. A linear plot would show a

1.3 Users’ Daily Usage

long-tailed distribution, with the peak close to the left and aFirst, we examine daily usage volumes for broadband andslow gradual decrease toward the right.

mobile users from several angles. Daily usage indicates theaverage daily usage calculated from a week’s worth of data

The OUT distribution is further to the right than the IN dis-for each user.

tribution, indicating that download volume is more than anorder of magnitude larger than upload volume. The peaks

Starting with this edition, we use daily usage data onlyof both the IN and OUT distributions for 2019 are slightly

on services provided to individuals. Enterprise usage var-further to the right than the peaks of the 2018 distributions,

ies widely and is readily influenced by the usage patterns

indicating that overall user traffic volumes are increasing.

of a subset of users, such that the overall distribution is

But that rightward shift in the distribution in 2019 was

clearly distorted. Individual usage, by contrast, shows asmaller than it had been in the past few years.

smooth distribution that remains stable. So we determinedthat using only the individual data to ascertain usage pat-

The peak of the OUT distribution, which appears toward theterns would yield more generally applicable and easilyright in the plot, has steadily been moving rightward over

0.8

0.8

0.4

0.2

0 4
10
（10KB）

2018（IN）
2018（OUT）
2019（IN）
2019（OUT）

0.6

Probability Density

Probability Density

0.6

Mobile（2019）2018 (IN)2018 (OUT)
2019 (IN)2019 (OUT)

0.4

0.2

5

6

10
10
（100KB） （1MB）

7

8

9

10
10
10
（10MB） （100MB） （1GB）

10

11

10
10
（10GB） （100GB）

0 4
10（10KB）

5

10（100KB）

6

10
（1MB）

7

8

10
10
（10MB） （100MB）

9

10
（1GB）

10

Users’ Daily Traffic Volume (Bytes)

Users’ Daily Traffic Volume (Bytes)

Figure 2: Daily Broadband User Traffic Volume Distribution
Comparison of 2018 and 2019

Figure 3: Daily Mobile User Traffic Volume Distribution
Comparison of 2018 and 2019

© Internet Initiative Japan Inc.

11

10
10
（10GB） （100GB）

5

the past few years, but heavy-user usage levels have notdata when out of the home/office as well as limits on mo-increased much, and as a result, the distribution is becoming

bile data. Hence, the daily average for a week’s worth ofless symmetric. The IN distribution on the left, meanwhile, isdata shows less variability between users than the data

generally symmetric and closer to a log-normal distribution.

for individual days. Plotting the distributions for individualdays in the same way results in slightly lower peaks and

The data for mobile traffic indicate that usage volumes arecorrespondingly higher tails on both sides, but the basic

significantly lower than for broadband. And limits on mo-shape and modal values of the distribution remain largely

bile data usage mean that heavy users, which fall on theunchanged. The difference in the mobile distributions versus

right-hand side of the distribution, account for only a smalllast year is also minimal.

proportion of the total, so the distribution is asymmetric.
There are also no extremely heavy users. The variability in

Table 1 shows trends in the mean and median daily trafficeach user’s daily usage volume is higher for mobile than forvalues for broadband users as well as the mode (the most fre-broadband owing to there being users who only use mobile

quent value, which represents the peak of the distribution).

Table 1: Trends in Mean and Mode of
Broadband Users’ Daily Traffic Volume
IN (MB/day)OUT (MB/day)

Year

Mean

MedianMode

MeanMedian

Mode

2007

436

5

5

718

59

56

2008

490

6

6

807

75

79

2009

561

6

6

973

91

100

2010

442

7

7

878

111

126

2011

398

9

9

931

144

200

2012

364

11

13

945

176

251

2013

320

13

16

928

208

355

2014

348

21

28

1124

311

501

Year

Mean

Median

2015

351

32

45

1399

443

708

2015

6.2

2016

361

48

63

1808

726

1000

2016

7.6

Table 2: Trends in Mean and Mode of
Mobile Users’ Daily Traffic Volume
IN (MB/day)
MeanMedian

Mode

3.2

4.5

49.2

23.5

44.7

4.1

7.1

66.5

32.7

63.1

2017

391

63

79

2285

900

1259

2017

9.3

4.9

7.9

79.9

41.2

79.4

428

66

79

2664

1083

1585

2018

10.5

5.4

8.9

83.8

44.3

79.4

2019

479

75

89

2986

1187

1995

2019

11.2

5.9

8.9

84.9

46.4

79.4

11

10

11

10

10

10

9

10

8

10

7

10

6

10

5

Mobile (2019)

Total (2019)
10

10
10
10
10
10
10

User’ s Daily Upload Volume (Bytes)

10

User’ s Daily Upload Volume (Bytes)

Mode

2018

10

9

8

7

6

5

4
4

10
(10KB)

6

OUT (MB/day)

5

10(100KB)

6

10
(1MB)

7

10
(10MB)

8

10(100MB)

9

10
(1GB)

10

10
(10GB)

11

10(100GB)

10 4

4

10
(10KB)

5

10(100KB)

6

10
(1MB)

7

10
(10MB)

8

10(100MB)

9

10
(1GB)

User’ s Daily Download Volume (Bytes)

User’ s Daily Download Volume (Bytes)

Figure 4: IN/OUT Usage for Each Broadband User

Figure 5: IN/OUT Usage for Each Mobile User

© Internet Initiative Japan Inc.

10

10
(10GB)

11

10(100GB)Nov.2019

Vol.

44

1. Periodic Observation Report

The peak was slightly off from the center of the distribution,

For broadband traffic, there was previously a clearly recog-so the distribution was adjusted to bring the mode toward

nizable cluster of heavy users spread out thinly about thethe center. Comparing the values for 2018 and 2019, theupper right of the diagonal, but this is now no longer dis-IN mode rose from 79MB to 89MB and the OUT mode rose

cernible. Variability between users in terms of usage levels

from 1,585MB to 1,995MB, translating into a growth factor

and IN/OUT ratios is wide, indicating that there is a diverseof 1.3 for both IN and OUT. Meanwhile, because the means

range of usage styles. There is almost no difference be-

are influenced by heavy users (on the right-hand side of thetween these plots and those for 2018, too.

distribution), they were significantly higher than the corresponding modes, with the IN mean being 479MB and the

For mobile traffic, the pattern of OUT being an order of magni-

OUT mean being 2,986MB in 2019. The 2018 means weretude larger also applies, but usage volumes are lower than for

428MB and 2,664MB, respectively.

broadband, and there is less variability between IN and OUT.

For mobile traffic (Table 2), the mean and modal values are

Figure 6 and Figure 7 show the complementary cumulative

close owing to the lack of heavy users. In 2019, the IN

distribution of users’ daily traffic volume. On these log-log

mode was 9MB and the OUT mode was 79MB, while theplots, the Y-axis values represent the proportion of users

means were IN 11MB and OUT 85MB. The modes for bothwith daily usage levels greater than the corresponding

IN and OUT traffic were identical to those for the previ-

X-axis values. These plots are an effective way of exam-

ous year. The modes were unchanged but the means andining the distribution of heavy users. The linear-like decline

medians increased, which reflects a slight decrease in the

toward the right-hand side of the plots indicates that the

proportion of light users, corresponding to the part of the

distributions are long-tailed and close to a power-law distri-

distribution to the left of the peak in Figure 2.

bution. Heavy users appear to be distributed statistically anddo not appear to constitute a separate, special class of user.

Figure 4 and Figure 5 plot per-user IN/OUT usage volumes
for random samples of 5,000 users. The X-axis shows

On mobile, heavy users appear to be distributed accord-

OUT (download volume) and the Y-axis shows IN (upload

ing to a power-law for OUT traffic, but the linear-like slope

volume), with both using a logarithmic scale. Users withbreaks down somewhat for IN traffic, with a large propor-

identical IN/OUT values fall on the diagonal.

tion of users uploading large volumes of data.

The cluster spread out below and parallel to the diagonal in

Traffic is heavily skewed across users, such that a smalleach of these plots represents typical users with download

proportion of users accounts for the majority of overall traf-

volumes an order of magnitude higher than upload volumes.

fic volume. For example, the top 10% of broadband users

10

0

10

In
Out

-1

In
Out

-1

10

-2

Probability Distribution

Probability Distribution

10

0

10

-3

10

-4

10

-5

-2

10

-3

10

-4

10

-5

10

10
Total (2019)

-6

10

4

10
(10KB)

5

10(100KB)

Mobile (2019)
6

10
(1MB)

7

10
(10MB)

8

10(100MB)

9

10
(1GB)

10

10
(10GB)

11

10(100GB)

12

10
(1TB)

-6

10

4

10
(10KB)

5

10(100KB)

6

10
(1MB)

7

10
(10MB)

8

10(100MB)

9

10
(1GB)

10

10
(10GB)

Users’ Daily Traffic Volume (Bytes)

Users’ Daily Traffic Volume (Bytes)

Figure 6: Complementary Cumulative Distribution of
Broadband Users’ Daily Traffic Volume

Figure 7: Complementary Cumulative Distribution of
Mobile Users’ Daily Traffic Volume© Internet Initiative Japan Inc.

11

10
(100GB)

12

10
(1TB)

7

account for 52% of total OUT and 82% of total IN traffic,

Table 3 shows the percentage breakdown of broadband

while the top 1% of users account for 17% of OUT and 58%

users’ usage by port over the past five years. In 2019, 81%

of IN traffic. As the proportion of heavy users has declinedof all traffic was over TCP connections. The proportion ofover the past few years, the skew has also decreased, albeit

traffic over port 443 (HTTPS), which was down a little last

only slightly. As for mobile, the top 10% of users account for

time, rose sharply from 41% to 52%. The proportion of traf-

43% of OUT and 47% of IN traffic, while the top 1% accountfic over port 80 (HTTP) fell from 27% to 20% here, and thefor 12% of OUT and 18% of IN traffic. The skew is less pro-figure for UDP port 443, which is used by Google’s QUIC

nounced than indicated in our reports up to last year because

protocol, fell from 10% to 8% after having risen up until the

we are now looking only at data on individuals.

previous edition of this report. These figures demonstratethat the shift from HTTP to HTTPS is ongoing, while QUIC

1.4 Usage by Port

has tapped the brakes on growth a little.

Next, we look at a breakdown of traffic and examine usage
levels by port. Recently, it has become difficult to identify

TCP dynamic port traffic, which has been on the de-applications by port number. Many P2P applications use dy-

cline, fell to 8% in 2019. The proportion accounted fornamic ports on both ends, and a large number of client/

by individual dynamic port numbers is tiny, with the mostserver applications use port 80, which is assigned to HTTP,

commonly used port 8080 only accounting for 0.5%. Port

to avoid firewalls. Hence, generally speaking, when both

1935, which is used by Flash Player and has also been inparties are using a dynamic port numbered 1024 or higher,

decline, fell to around 0.3%. Almost all other traffic here

the traffic is likely to be from a P2P application, and when

is VPN related.

one of the parties is using a well-known port lower thanap-

Table 4 shows the percentage breakdown by port for mobile

plication. In light of this, we take the lower of the source

users. The figures are close to those for broadband on theand destination port numbers when breaking down TCP andwhole, suggesting that mobile users use applications in a

UDP usage volumes by port.

manner similar to broadband users.

1024, the traffic is likely to be from a client/server

Table 3: Broadband Users’ Usage by Port

8

year

2015

2016

2017

2018

2019

protocol port

(%)

(%)

(%)

(%)

(%)

TCP

80.8

82.8

83.9

78.5

81.2

(< 1024)

63.3

69.1

72.9

68.5

73.3

Table 4: Mobile Users’ Usage by Port

year

2015

2016

2017

2018

2019

443 (https)

23.3

30.5

43.3

40.7

51.9

protocol port

(%)

(%)

(%)

(%)

(%)

80 (http)

37.9

37.1

28.4

26.5

20.4

TCP

93.8

94.4

84.4

76.6

76.9

993 (imaps)

0.1

0.1

0.2

0.2

0.3

443 (https)

37.4

43.7

53.0

52.8

55.6

22 (ssh)

0.2

0.2

0.1

0.1

0.2

80 (http)

52.5

46.8

27.0

16.7

10.3

182

0.4

0.3

0.3

0.3

0.2

31000

0.0

0.2

1.8

2.9

6.4

(>= 1024)

17.5

13.7

11.0

10.0

7.89

993 (imaps)

0.5

0.5

0.4

0.3

0.3

8080

0.3

0.2

0.3

0.3

0.5

1935 (rtmp)

0.5

0.3

0.2

0.1

0.1

1935 (rtmp)

1.8

1.5

1.1

0.7

0.3

UDP

5.2

5.0

11.4

19.4

17.3

UDP

11.4

11.1

10.5

16.4

14.1

443 (https)

1.0

1.5

7.5

10.6

8.3

443 (https)

0.9

2.4

3.8

10.0

7.8

12222

0.0

0.1

0.1

2.3

3.4

4500 (nat-t)

0.2

0.2

0.2

0.2

0.3

4500 (nat-t)

0.3

0.2

0.2

4.5

3.0

ESP

7.4

5.8

5.1

4.8

4.4

53 (dns)

0.1

0.2

0.1

0.1

0.1

IP-ENCAP

0.2

0.2

0.3

0.2

0.2

ESP

0.7

0.4

0.4

3.9

5.8

GRE

0.2

0.1

0.1

0.1

0.1

GRE

0.3

0.1

0.1

0.1

0.0

ICMP

0.0

0.0

0.0

0.0

0.0

ICMP

0.0

0.0

0.0

0.0

0.0

© Internet Initiative Japan Inc.

Nov.2019

Vol.

44

1. Periodic Observation Report

Figure 8 compares overall broadband traffic for key port

1.5 Conclusioncategories across the course of the week from which obser-

Traffic volume has been growing moderately over the pastvations were drawn in 2018 and 2019. We break the data

few years. Although I say “moderately”, it’s only moderate

into four port buckets: TCP ports 80 and 443, dynamic ports

in relation to past growth. At its annual rate of 20%, traffic(1024 and up), and UDP port 443. The data are normalized

is set to more than double over a four-year period. Bothso that peak overall traffic volume on the plot is 1. By com-

broadband and mobile traffic have been increasing, albeit

parison with 2018, the proportion of traffic over TCP portwith some ups and downs. The fact that both tend to rise

443 has risen even further whereas TCP port 80 has seen

and fall around the same time suggests that common fac-a decrease. The overall peak is between 19:00 and 23:00

tors are at play, but we have not been able to pinpoint what

hours. Traffic increases during the daytime on Saturday andthe specific factors are.

Sunday, reflecting household Internet usage times.
Both broadband and mobile usage volume by user have not
Figure 9 shows the trend for TCP ports 80 and 443 andchanged much in the past few years. No new services that

UDP port 443, which account for the bulk of mobile traf-

would drive traffic upward have appeared over that time,

fic. In the mobile space as well, TCP port 443 has seen an

and it is clear that users’ Internet usage has not changed

increase while the proportion of traffic over TCP port 80

much as a result. Video resolutions are definitely on the rise,has declined. When compared with broadband, we note that

but it looks like the accompanying rise in codec compression

mobile traffic levels remain high throughout the day, fromrates is keeping total traffic growth in check.

morning through night. The plot shows that usage times
differ from those for broadband, with three separate mobile
traffic peaks occurring on weekdays: morning commute,lunch break, and evening from 17:00 to 22:00 hours.

Figure 8: Broadband Users’ Port Usage Over a Week
2018 (top) and 2019 (bottom)

Figure 9: Mobile Users’ Port Usage Over a Week
2018 (top) and 2019 (bottom)

Kenjiro Cho
Research Director, Research Laboratory, IIJ Innovation Institute Inc.

© Internet Initiative Japan Inc.

9