Towards a Macroscopic View of Internet Traffic

Abstract

The Internet is critical infrastructure for communication, commerce, and public services, but it remains difficult to characterize beyond local views. Many aspects of its behavior are well understood at the level of individual networks, devices, paths, and applications. Yet less is known about its macroscopic properties: how its topology is structured, how resilient it is, and how its traffic varies across regions and evolves over time. These questions are difficult to answer because the relevant evidence is scattered across independent operators, platforms, exchanges, and measurement infrastructures, and is often private, partial, heterogeneous, or aggregated. This thesis studies macroscopic Internet behavior along three dimensions: topology, resilience, and traffic. It presents three macroscopic studies that develop models, analyses, and datasets for path inference, outage analysis, and public interconnection traffic measurement. It also presents one microscopic study: a programmable-switch system for detecting a specific encrypted Voice over IP (VoIP) calling pattern at line rate. The studies draw on four kinds of evidence. The microscopic study uses in-path packet observations to detect encrypted VoIP calls without inspecting payloads. The topology study compares AS-level abstractions with router-level models on generated Internet-scale topologies with known ground truth to evaluate how routing-model granularity affects path inference. The resilience study reconstructs time series for outage-related queries from publicly available aggregate search-interest data and uses them as complementary evidence for detecting and characterizing user-affecting disruptions. The traffic study collects and normalizes public statistics from 472 Internet Exchange Points (IXPs) to analyze growth, regional patterns, and event-related changes in the public interconnection fabric. Each macroscopic study reveals a different, less understood aspect of the Internet. Regarding topology, experiments on generated topologies show that additional vantage points do not raise AS-level path precision beyond 57%, while a router-level model reaches 86% with 5% vantage-point coverage. Regarding resilience, power-related annotations accompany 73% of outage-related search spikes lasting at least five hours. Regarding traffic, the results show substantial regional variation: traffic across the observed IXPs grew by 49% over 2023–2024, with 108% growth in Asia-Pacific and 15% in Europe.

People

Ege Cem Kırcı

PhD student

BibTex

@phdthesis{kirci2026towards,
  author    = {Kirci, Ege Cem},
  title     = {{Towards a Macroscopic View of Internet Traffic}},
  year      = 2026,
  month     = jul,
  publisher = {ETH Zurich},
  doi       = {10.3929/ETHZ-C-000803793},
  url       = {https://www.research-collection.ethz.ch/bitstream/handle/20.500.11850/803793/thesis-electronic.pdf},
  school    = {ETH Zurich}
}

Research Collection: 20.500.11850/803793