How enterprise networking is changing with a work-at-home workforce

As the coronavirus spreads, public and private companies as well as government entities are requiring employees to work from home, putting unforeseen strain on all manner of networking technologies and causing bandwidth and security concerns.  What follows is a round-up of news and traffic updates that Network World will update as needed to help keep up with the ever-changing situation.  Check back frequently!


In an April 2nd call with the Federal Communications Commission chair, the nation's largest telecom and broadband providers reported network usage during the COVID-19 pandemic had risen about 20-35% for fixed networks and 10-20% for cellular networks in recent weeks. In general, company representatives reported that their networks were holding up quite well, and they expected that resilience to continue. In their conversation with Chairman Ajit Pai, no providers expressed concern about their networks' ability to hold up to increased and changing demand.

"Operators cited a general migration of traffic to suburban, exurban, and residential areas as more people work, learn, and access services from home during the pandemic.  They said they would continue to monitor hotspots to be ready for any issues and proactively increase capacity in case peak traffic rises unexpectedly," the FCC stated. The call included Altice USA, AT&T, CenturyLink, Charter, Cincinnati Bell, Consolidated Communications, Comcast, Cox, DISH, Frontier, Hughes, Mediacom, Northwest Fiber, Sprint, T-Mobile, TDS Telecom, TracFone, U.S. Cellular, Verizon, ViaSat, and Windstream.

Broadband Now reported on April 1 that more of America's most populous cities saw decreases in median download speeds this week compared to the last. 117 cities (59%) have now shown signs of potential network strain, up from 88 cities (44%) in the previous week's report.  The company wrote that 117 (59%) of the top 200 cities it was tracking have experienced download-speed degradations over the past week compared to the first 10 weeks of 2020. Five cities have observed download speed dips greater than 40%. In addition, 144 (72%) cities have experienced degradation in upload speeds, with three seeing decreases greater than 40%.

Verizon reported that its Northeast and Mid-Atlantic regions appear to have the most people in the nation staying at home, according to its Verizon Network Report. Online collaboration surge nearly 10X versus a typical day, and growth in other internet uses has started to stabilize.

Meanwhile, AT&T said its core network traffic - which includes business, home broadband and wireless usage - was up 18% through April 1 compared to the same day in March. In a blog AT&T also noted a 700% increase in connections to its secure, cloud-based SD-WAN Static Network Based (ANIRA) service in the past few weeks.  ANIRA uses IPSec to authenticate and encrypt data packets over the broadband network.

As many business and consumer users deploy videoconference services one of the most popular - Zoom - has also attracted attackers.  So much so that the FBI on April 1 issued a warning saying that as large numbers of people turn to video-teleconferencing (VTC)  to stay connected, reports of VTC hijacking, or "Zoom-bombing," are emerging nationwide.

Malicious actors may target communication tools including VoIP phones, video conferencing equipment and cloud-based communications systems to overload services and take them offline or eavesdrop on conference calls. Cyber actors have also used VTC hijacking to disrupt conferences by inserting pornographic images, hate images or threatening language.

As a result, some companies have banned or limited the use of Zoom, reports say. Reuters for example wrote that Elon Musk's rocket company SpaceX has banned its employees from using Zoom, citing "significant privacy and security concerns." The FBI offered the following steps to help mitigate the problem:

UPDATE: 3.30

AT&T said its core network traffic - which includes business, home broadband and wireless  - was up 24% through March 30 compared to the same day last month.  It broke down some mobility traffic patterns as well: voice calls: +33%, instant messaging: +63%, text messaging: +41%, email: -18%, web browsing: -5%, video: +4% (also accounts for over half of all mobility traffic). It also usage for conferencing: AT&T's global audio-conferencing solution: +200%; audio, web and video conferencing tools: +400%; Large-scale webcast events: +200%.

AT&T said its investment in artificial intelligence technology is helping it keep up with demand. For example, the company said AI is helping remotely troubleshoot and diagnose problems with customer equipment, by identifying the cause or even proactively identifying a potential issue before it occurs. "We've expedited deployments of new AI capabilities in certain markets that will allow us to balance the traffic load within a sector and across sectors to help avoid overloading specific cells and improve the experience."

DNS vendor BlueCat says it has been tracking the use of DNS over HTTPS (DoH) - a method of encrypting queries to prevent visibility into DNS traffic patterns.  Over the last week through March 27, the company said it has  seen a massive increase in the use of DoH across its customer base wrote Ben Ball, director of strategy and content marketing at BlueCat in a blog about the trend. "In the course of a single weekend, the number of endpoints attempting to use DoH went from an average of 90 to about 1,400.  That's a 1,500% increase in the use of DoH. Around 45% of these queries are from Firefox (which now activates DoH by default).  Aside from that, we're seeing queries to eleven different DoH services from all kinds of applications. DoH usage is fairly uniform across our customer base as well - this isn't one company or industry vertical; this is a broad trend. While we haven't seen any clear indications that any of these queries are from DoH enabled malware, that is an emerging threat that we are tracking," Ball stated.

Ookla's SpeedTest shows mean download speed over fixed broadband declined only slightly in Mexico and the U.S. when comparing the week of March 23 to that of March 16, while a decline in Canada's mean download speed over fixed broadband was more evident. Mean download speed over mobile was down in the U.S. and Canada during the week of March 23, while it rose slightly in Mexico during the same period.


Broadband watchers at BroadbandNow say users in most of the cities it analyzed are experiencing normal network conditions, suggesting that ISP's (and their networks) are holding up to the shifting demand. In a March 25 post the firm wrote: "Encouragingly, many of the areas hit hardest by the spread of the coronavirus are holding up to increased network demand. Cities like Los Angeles, Chicago, Brooklyn, and San Francisco have all experienced little or no disruption. New York City,  now the epicenter of the virus in the U.S., has seen a 24% dip out of its previous ten-week range. However, with a new median speed of nearly 52 Mbps, home connections still appear to be holding up overall."

Other BroadbandNow findings included:

Cisco's Talos threat-intelligence arm wrote on March 26 about the COVID security threat noting what it called three broad categories of attacks leveraging COVID with known advanced persistent threat participation in: Malware and phishing campaigns using COVID-themed lures; attacks against organizations that carry out research and other work related to COVID; and fraud and disinformation. From an enterprise security perspective, Talos recommended:

In an FAQ about the impact of COVID-19 on fulfilling customer hardware orders, VMware stated: "Some VMware SD-WAN hardware appliances are on backorder as a result of supply chain issues. As a result, we are extending the option to update existing orders with different appliances where inventory is more readily available. Customers may contact a special email hotline with questions related to backordered appliances. Please send an email to [email protected] with your questions and include the order number, urgent quantities, and contact information. We will do our best to respond within 48 hours."

Cisco said it has been analyzing traffic statistics with major carriers across Asia, Europe, and the Americas, and its data shows that typically, the most congested point in the network occurs at inter-provider peering points, Jonathan Davidson, senior vice president and general manager of Cisco's Mass-Scale Infrastructure Group wrote in a blog on March 26. "However, the traffic exchanged at these bottlenecks is only a part of the total internet traffic, meaning reports on traffic may be higher overall as private peering and local destinations also contribute to more traffic growth."

"Our analysis at these locations shows an increase in traffic of 10% to 33% over normal levels. In every country, traffic spiked with the decision to shut down non-essential businesses and keep people at home. Since then, traffic has remained stable or has experienced a slight uptick over the days that followed," Davidson stated.

He said that traffic during peak hours from 6 p.m. and 10 p.m. has increased slightly, but is not the primary driver for the overall inrease. Busy hours have extended to 9 a.m. 10 p.m., although the new busy-hour (9 a.m. to 6 p.m.) traffic is still below the traditional peak hours. "Service providers are certainly paying attention to these changes, but they are not yet a dire concern, as most networks are designed for growth. Current capacities are utilized more over the course of the entire day," he wrote.

Spanish multinational telecommunications company Telefonica' said IP networks are experiencing traffic increases of close to 40% while mobile voice use is up about 50% and data is up 25%. In general, traffic through IP networks has experienced increases of nearly 40% while mobile use has increased by about 50% for voice and 25% for data. Likewise, traffic from instant-messaging tools such as Whatsapp has increased fivefold in recent days.