6 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
This article explores the characteristics of TCP connections across Cloudflare's global CDN, focusing on metrics like packet counts and response behaviors. It highlights the challenges of measuring network connections at scale and presents data that reveals patterns in Internet traffic, including the distribution of small and large flows.
If you do, here's more
Every interaction on the Internet begins with a connection, where packets flow between devices. Despite decades of interest in characterizing these connections, comprehensive data on global Internet connections remains scarce. Researchers often rely on local tools like Wireshark, but measuring connections on a larger scale is difficult due to access issues and a lack of shared data among network operators. Cloudflare attempts to fill this gap by analyzing TCP connections, which make up about 70% of HTTP requests to their global Content Delivery Network (CDN).
Cloudflare's dataset offers insights into TCP connections established from October 7 to October 15, 2025. They analyzed a 1% sample of all TCP connections, focusing on those that closed gracefully with a FIN packet and had at least one successful HTTP request. This careful selection process avoids idle connections and provides a clearer picture of actual user interactions. The data reveals diverse traffic patterns, influenced by a wide range of web applications and devices due to Cloudflare’s variety of customers.
The article also visualizes connection characteristics using cumulative distribution function (CDF) graphs. These graphs illustrate the distribution of response packets sent back to clients, showing a heavy-tailed distribution. The average response consists of about 240 packets, but the median is only 12 packets, indicating that most connections involve minimal data. Different HTTP versions show distinct patterns: HTTP/1.X connections have a median of 10 packets while HTTP/2 connections average 16 packets. This distinction reflects the protocol's ability to handle larger data transfers more efficiently.
Questions about this article
No questions yet.