CDN Analytics

CDN Analytics is covered in the following topics:

• About CDN Analytics
• CDN Analytics Page
• Individual CDN Page

General information about CDN Analytics is provided in the following topics:

• CDN Analytics Overview
• CDN Attribution Dimensions
• CDN Types

Kentik’s CDN Analytics workflow is primarily of interest to “eyeball” ISPs, whose subscribers are the consumers of vast amounts of content transported by Content Delivery Networks. To optimize a network for this heavily inbound traffic profile, an ISP needs to understand the nature of CDN-transported traffic (video, gaming, social, etc.) as well as how this traffic is handed over to the network (at which cost and at what performance). The basic attributes available from traditional flow telemetry are of little help in this regard, and the picture is further complicated by the fact that content providers typically use multiple CDNs, each of which dynamically modifies their methods and routing in response to changing constraints such as capacity, cost, and weather. By enriching flow records with data derived via non-flow techniques, Kentik is able to provide eyeball ISPs with unsurpassed visibility into their CDN traffic.

CDN Analytics is based on Kentik technology that makes it possible for us to determine whether a given flow record originated or terminated with a commercial CDN, and to store that information for each record using the following two dimensions (see Application Context and Security):

• Source CDN: The commercial name of the CDN derived from the source IP of an ingested flow.
• Destination CDN: The commercial name of the CDN derived from the destination IP of an ingested flow.
  Note: This dimension enables you to track "fill traffic" that is pointed toward a CDN server to fill a local cache.

Once stored in the Kentik Data Engine (KDE; see KDE Tables), the columns (src_cdn, dst_cdn) corresponding to these dimensions can be used in the Kentik queries underlying the CDN Analytics workflow.

Each Kentik-identified CDN is defined as belonging to the following CDN types (a given CDN may be more than one type):

• Commercial: Global content delivery services — including Akamai, Level3, Limelight, Edgecast, Fastly, and Cloudflare — that are sold to content providers.
• Cloud: Commercial CDN offerings from public cloud providers, including Cloudfront (AWS), Google CDN (GCP), and Azure CDN (Microsoft).
• Content: Purpose-built CDNs that are owned and operated by content providers for their own primary use, including Netflix’s Open Connect (OCA) program, Facebook’s FNA program, and Google’s GGC Program.
• Telco: CDNs owned by large telecommunication providers (carriers) that also sell connectivity, colocation, and/or transit, including Level3, Comcast, AT&T, Telefonica, and Tata Communications.

The CDNs page is covered in the following topics:

• CDNs Page Layout
• Did You Know Pane
• Embedded Caching Pane
• CDNs List

The CDN Analytics page includes the following main UI elements:

• Time Range selector: Indicates the duration, back from the present, for which the information displayed on this page has been calculated.
• Peak Traffic indicator: The peak traffic volume that occurred during the time range.
• Traffic chart: A line chart showing overall traffic volume over the time range.
• Did you know pane: A set of indicators with useful/relevant information about your organization’s CDN traffic (see Did You Know Pane).
• Embedded Caching pane: A set of indicators, one for each of the primary CDNs using embedded caching, that show the CDN’s cache-sourced traffic as a percent of their overall traffic (see Embedded Caching Pane).
• CDNs list: A list of the CDNs from which your network is receiving traffic (see CDNs List).

The Did You Know pane highlights useful/relevant statistics regarding the CDN traffic on your network. The following indicators are included:

• Top 5 CDNs: The percent of traffic to your network’s subscribers that comes either directly from the top five Kentik-identified CDNs or from caches embedded in your network by those CDNs, which are listed in the panel.
• Non-CDN Traffic: The volume of traffic to your network’s subscribers that does not come from either a Kentik-identified CDN or an embedded cache.
• CDN Traffic via Transit: The percent of your traffic from Kentik-identified CDNs that is delivered via transit, which is typically the most costly and least performant approach.
• CDNs Mapped: The current number of Kentik-identified CDNs.

To improve performance for popular high-bandwidth content, several of the major CDNs (e.g. Facebook Appliance, Google Global Cache, Netflix Open Connect, Akamai Caches, etc.) provide ISPs with cache appliance servers that are located in ISP datacenters, as close as possible to content consumers (ISP subscribers). Content is served from these caches and refreshed via proxy feed during off-peak hours. Using Interface Classification, Kentik is able to identify the interfaces on your network that connect to these caches and to assign a Connectivity Type of “Embedded Cache” to inbound traffic on those interfaces.

The Embedded Caching pane includes a panel for each of the primary CDNs that use embedded caching. Each panel shows the following information:

• Offloaded percent: The CDN’s Embedded Cache traffic as a percent of its overall traffic.
• Peak cache performance: Maximum bits per destination IP going to subscribers from the CDN's embedded cache.

The CDNs list is a table showing the CDNs from which your network is receiving traffic. Using the CDN Types filter field, the list can be filtered to show only CDNs of one or more types.

Each row in the CDNs list includes the following columns:

• CDN Types: A field in which to specify which types of CDNs (see CDN Types) to list in the table.
• Source CDN: A Kentik-identified CDN.
• Peak Subscriber Traffic: The peak bitrate of traffic from the CDN to subscribers during the currently specified time range.
• Max Unique Subscribers: The peak count of subscribers simultaneously receiving content from this CDN during the currently specified time range.
• Max Mbits/s per Subscriber: The highest bitrate, averaged across subscribers, at which traffic was received from the CDN during the currently specified time range. The value is calculated by comparing the bitrate for each interval (aggregation step) in the time range divided by the number of subscribers receiving data from that CDN during that slice.
• Last Datapoint: The bitrate of subscriber traffic at the last datapoint in the currently specified time range.
• Last Datapoint Unique Subscribers: The count of subscribers simultaneously receiving content from this CDN at the last datapoint in the currently specified time range.
• Last Datapoint Mbits/s per Subscriber: The bitrate for the last time slice (aggregation step) in the time range divided by the number of subscribers receiving data from that CDN during that slice.

Note: In the table described above:
- The “subscriber traffic” shown in each row is traffic to your network’s subscribers that comes either directly from the Kentik-identified CDN or from caches embedded in your network by the CDN.
- The time slices used for data aggregation vary depending on the duration of the time range; see Time Rounding.

The pages for each individual CDN are covered in the following topics:

• CDN Page Layout
• Information Pane
• Offload Profile
• CDN Transport Breakdown
• Top OTT Services

The individual CDN pages include the following main UI elements:

• Filters control: A selector that enables you to choose one or more dimensions by which to narrow the traffic displayed in the charts and tables of this page. For an explanation of the control, as well as a list of available dimensions, see Filters Control.
• Time Range selector: Indicates the duration, back from the present, for which the information displayed on this page has been calculated (see Time Range Selector).
• Information pane: Useful information about the CDN, including its CDN Types and ASN; see Information Pane.
• Offload Profile: A breakdown of the types of connections over which your subscribers are receiving content from the CDN; see Offload Profile.
• CDN Transport Breakdown: A breakdown — by connectivity type, provider, and site — of the traffic transported to your network by this CDN (see CDN Transport Breakdown).
• Top OTT Services: A chart and top-X list showing the individual OTT content services via which traffic is coming to your network from the CDN (see Top OTT Services).

This pane presents general information about how the CDN operates and thus what impact it is having on your network. the pane is divided into two parts:

• CDN Types: Shows the CDN categories (see CDN Types) assigned to this CDN by Kentik.
• Owned and Operated ASNs: Lists the ASes controlled by the CDN. Click on an ASN in the list to see a Quick View detailing traffic on the corresponding AS.

This pane provides a breakdown of the types of connections over which your subscribers are receiving content from the CDN. The types are determined by the connectivity type of the interfaces through which traffic from the CDN enters your network (see Understanding Connectivity Types).

The breakdown shows the percentage of traffic from the CDN that is attributed to various connectivity types. The percentages are displayed numerically in panels across the top of the pane (below the help text), and graphically in the stacked area chart below those panels. The following connectivity types are represented in the breakdown: Cache, Transit, IX, and Free Private Peering.

The CDN Transport Breakdown pane provides a breakdown — by connectivity type, provider, and site — of the traffic transported to your network by this CDN. The pane includes two main elements, the CDN Transport Chart and the CDN Transport Table.

The CDN Transport Chart is a Sankey diagram in which each path represents a unique combination of the following dimensions:

• Connectivity type: The type of connection over which traffic from this CDN enters your network (see Understanding Connectivity Types).
• Provider: The provider via which traffic from this CDN enters your network (see Provider Classification).
• Site: The site where the provider receives traffic from the CDN that goes to your network (see About Sites).
• CDN: This CDN.
• Source ASN: The origin ASN associated with the source IP of the traffic.

The CDN Transport Table lists the unique paths by which traffic from this CDN enters your network. Click a heading to change sort order. Each row represents the dimension values that define the path as well as associated metrics, whose values correspond to the specified time range (see CDN Page Layout):

• Source Connectivity type: The type of connection over which traffic from this CDN enters your network (see Understanding Connectivity Types). Click the type to go to a Network Explorer page detailing that individual connectivity type (see Core Details Pages).
• Source Provider: The provider via which traffic from this CDN enters your network (see Provider Classification). Click the provider to go to a Network Explorer page detailing that individual provider.
• Site: The site where the provider receives traffic from the CDN that goes to your network (see About Sites). Click the site to go to a Network Explorer page detailing that individual provider.
• Average Gbits/s: The average traffic volume from the CDN to your network over this path.
• Average Unique Dst IPs: The average number of unique destination IPs over this path.
• Average Mbits/s per dst ip: The average traffic volume over this path divided by the average number of unique destination IPs.
• Last Datapoint Gbits/s: The traffic volume at the last data point in the time range.

This pane shows the individual OTT content services, whose hostnames are identified by DNS, via which traffic is coming to your network from the CDN. The pane includes two main elements, the Top OTT Services Chart and the Top OTT Services List.

This stacked area chart shows the distribution over time (as defined by the page's time range) of the OTT services used by traffic coming to your network from the CDN. Hover over the chart for a breakdown of traffic via the top services at a given point in time.

This table lists the OTT services via which traffic comes to your network from this CDN. Using the Classification Types filter field, the list can be filtered to show only services of one or more classification types.

Each row in the OTT Services list includes the following columns:

• OTT Service: An individual OTT content service whose hostname is looked up via DNS. Click the service name to go to an OTT Service Tracking page detailing that individual OTT service (see Service Details Pages).
• OTT Service Type: The nature of the content provided by an OTT content service (for possible values, see Application Context and Security). Click the service type to go to an OTT Service Tracking page detailing that individual OTT service type (see Service Category Details).
• OTT Service Provider: An entity that offers an OTT content service (e.g. Google is the provider for Google Drive, GMail, Google Maps, etc.). Click the provider name to go to an OTT Service Tracking page detailing that individual OTT service provider (see Service Provider Details).
• Classification: The extent to which Kentik has been able to classify the OTT service, service type, and service provider (see OTT Classification Values).
• Max Gbits/s: The traffic volume from the CDN via this service during the interval (aggregation step) with the highest traffic volume.
• Max Unique Dst IPs: The number of unique destination IPs via this service during the interval (aggregation step) with the highest count of destination IPs.
• Max Mbits/s per dst ip: Calculated by computing the bitrate per IP for each interval (aggregation step) and comparing to find the highest result.

Note: The intervals (aggregation steps) used to calculate the above maximum values vary depending on the specified Time Range setting (see CDN Page Layout), with a longer time range resulting in longer intervals.

The Classification column shows the extent to which Kentik has been able to classify the OTT Service Name, OTT Service Type, and OTT Provider Name (represented in KDE as Application Context and Security dimensions). the state of this classification for a given service is indicated with the following values:

• Full: The service, service type, and service provider have been identified.
• Unclassified: The service, service type, and service provider have not been identified.
• Provider-only: The service provider has been identified; service and service type have not. This indicates that the provider's services are all served from the same hosts (multiple simultaneous DNS queries towards different services return the same IP address).
• Pending: Traffic patterns from this CDN to your network (i.e. a hostname generating high traffic volume) indicate a service that hasn't yet been matched to an existing Kentik-identified OTT service.