The Tiger Effect

Internet Providers usually spend their time worrying about threats from
hackers, link failures, and router configuration errors. Yesterday,
though, many of them were worried about Tigers…

Starting around 9 am Pacific and peaking at 1:30 pm yesterday, many
ISPs noticed an unusual increase in traffic. At first, a few security
engineers worried they were under some type of new DDoS attack. But the flood
of traffic did not appear directed at any individual customer — the gigabits of anomaly
traffic surged to almost all customers from multi-national banks to the bakery down the
street and home DSL / Cable users. For several ISPs, traffic into their network grew
by 15-25%. In one provider, inbound traffic nearly doubled.

It turns out that the U.S. Open played at Torrey Pines yesterday
generated one of the larger Internet-wide flash crowds this
year. Traffic dipped and peaked corresponding to Tiger’s initial
misses and subsequent spectacular comeback as millions
of office bound fans tuned in to the live NBC and ESPN coverage.

The below graph shows data from 70 ISPs around the world sharing data
with Arbor’s Internet Traffic Observatory (we talked about this
project at the last NANOG). The orange filled area in the graph
represents the aggregate gigabits per second of Internet traffic to
TCP port 1935 (Flash Media) player into these 70 providers. The
accompanying chart helpfully provides a brief timeline of the
U.S. Open action.

Internet Traffic Due to the Tiger Effect

The Tiger Timeline

Although Tiger’s fame may be worldwide, the Internet flash-crowd
traffic was predominantly associated with North America providers. The
largest increases in traffic were seen out of Akamai and Limelight CDN
providers and their upstreams. For the most part, the Internet
infrastructure handled the increased traffic without a problem (though
some Observatory data shows traffic drops from a handful of ISPs to
the CDNs during peak periods of the U.S. Open).

Credit goes to Jason McEachin (one of Arbor’s Consulting Engineers) who
first observed the “Tiger Effect”.

29 Responses to “The Tiger Effect”

June 17, 2008 at 12:35 pm, Gloden said:

While the Internet infrastructure may have handled the increased traffic, the usopen website sadly did not. I sat at my desk hitting refresh and waiting over 30 minutes while the flash player attempted to stream the broadcast. In the end, I closed my browser, and turned on a TV.

June 17, 2008 at 5:17 pm, Donkey said:

Amazing that Gloden has a job… spent a half-hour trying to watch golf during the work day… sheesh!

June 18, 2008 at 4:38 pm, bppg said:

I wonder if some sort of peer to peer stream broadcasting technology could be more helpful to the ISPs in cases like this: You know, something that would work like bittorrent but instead of sending/recieving arbitrary chunks of a file, it recieves then sends the latest ones, with some sort of network route-finding algorithm to ensure as many people as possible get the most recently broadcasted chunk of the stream-file. Or am I on crack?

June 18, 2008 at 4:52 pm, whatithink » Blog Archive » Tiger Woods Nearly Brings Down The Internet said:

[…] Arbor Networks have a graph of the huge traffic spike, along with a time-line of play in the US Open. They’re calling it the Tiger Effect, which would seem to be the opposite of the Slashdot Effect. […]

June 18, 2008 at 5:21 pm, mmm french toast / the tiger effect said:

[…] Tiger’s win yesterday caused a major headache for internet service providers– read on. […]

June 18, 2008 at 6:43 pm, The Tiger Effect said:

[…] can read the full story here, but here’s the summary: Starting around 9 am Pacific and peaking at 1:30 pm yesterday, many […]

June 18, 2008 at 3:42 pm, Bob said:

Welcome to the IT world Donkey…

June 18, 2008 at 3:43 pm, Ben said:

Donkey – right, clearly Gloden was the only one. “I’ll take Missing the Point for $1000, Alex.”

June 18, 2008 at 3:43 pm, Google said:

Amazing that Donkey has time to sit around and write pointless comments, since his job obviously demands so much of his attention that he can’t spare 30 minutes… Sheesh!

June 18, 2008 at 3:57 pm, Watchdog said:

Must have been hard to get the buttt off the chair and pick up the remote. I hope the batteries worked..otherwise that could have been a real disaster. 🙂

June 18, 2008 at 8:25 pm, That's no DDoS attack, it's just Tiger - pcpartfinder said:

[…] enough to look like a massive denial-of-service attack to Internet service providers. According to Internet security company Arbor Networks, the playoff between Woods and Rocco Mediate "generated one of the larger Internet-wide flash […]

June 18, 2008 at 5:19 pm, zoroo said:

i watched the entire round on my buddies computer. Amazing. We need bigger pipes so that this is how tv is delivered to everyone. BTW, i got a bit of work done.

June 18, 2008 at 6:12 pm, Wahoo said:

Ha! Tiger woods indirectly DDoS’ing roughly 70 ISP’s… A new kevin mitnick!

June 18, 2008 at 6:40 pm, eclgrocks said:

I for one resent employees using company resources in this way

June 18, 2008 at 11:46 pm, me said:

This is one of the dumbest things I’ve heard to date. Do you really believe the US open has the capability to push *700* gigabits of stream to the net? And you guys claim to fend off attacks at AT&T, Comcast, Optimum and Verizon. So much for doing your homework..

June 19, 2008 at 3:33 am, links for 2008-06-19 | said:

[…] The Tiger Effect · Security to the Core | Arbor Networks Security Interesting anylasis of the increase in network traffic while Tiger Woods was playing at the US Open. (tags: isp internet video) […]

June 19, 2008 at 7:54 am, Tiger Woods Launches Denial of Service Attack on the Internet « The Four Part Land said:

[…] Tiger Woods Launches Denial of Service Attack on the Internet Yes, yes he did. […]

June 19, 2008 at 10:38 am, MeBeDumb said:

“me” wrote “Do you really believe the US open has the capability to push *700* gigabits of stream to the net?”. Read the article, most of the traffic was served by Akamai and Limelight… so yes I do really believe that they have the capability of serving 700 gigabits to the net.

June 19, 2008 at 10:56 am, Informed said:

Hey “me” – it strikes me that it is, in fact, you who should do your homework. The article clearly states that CDNs Akamai and Limelight were both doing the streaming on behalf of the US Open. Meaning, the US Open was paying for that type of streaming capacity.

It’s actually pretty reasonable that two of the biggest CDNs in the world can together push 700 Gbps of Flash streaming video. Looking at the graph though, there was a good 200 Gbps of baseline traffic there before the event, so it looks to me like Tiger drove more of a 500 Gbps spike.

June 19, 2008 at 1:29 pm, GolfFan said:

use tvuplayer ( it’s a p2p video streaming protocol for people who have media to share. in this case, the sharer was sharing ESPN (from satellite, tv, etc. into his PC) allowing the rest of us to watch the us open.

June 19, 2008 at 1:31 pm, The Roundtable » Blog Archive » The Tiger Effect and the US Open said:

[…] it appears people certainly did just that!  According to Arbor Networks, ISPs throughout the country saw a massive spike in streaming video during this time – about 3.5 […]

June 19, 2008 at 4:39 pm, Snaglepuss said:

We did see traffic spike, but we also saw a significant spike in darknet traffic over the same period. If this is just Tiger, why so much darknet traffic at the same time?
We saw a large spike of traffic to Limelight streaming media, but not until the next day.

June 20, 2008 at 10:38 am, wombat said:

Golf-watchers maxed out our OC3 internet link. Gonna have to put a hose clamp on the fiber to choke off Limelight and Akami traffic. Either that, or figure out how to shock end-users through the mouse and get them back to work.

Our traffic graphs on the day look just like the ones referenced above, and all of our excess traffic at the time was flash from Limelight.

June 22, 2008 at 6:35 am, Denying service to Tiger Woods | Business is Personal said:

[…] network engineer at Arbor Networks, noticed an interesting pattern to the Flash video traffic on the internet during Tiger and Rocco’s playoff […]

June 23, 2008 at 10:29 am, WebbAlert - June 23, 2008 | TechTV Update said:

[…] Was that a DDOS or just Tiger Woods? ISPs reported record traffic during the U.S. Open. […]

June 26, 2008 at 4:08 pm, Schwabby said:

Indications that we have to and will be watching for this type of bandwidth increase across our footprint with regard to upcoming events such as the Olympics, Election Coverage/Results, or this event may even provide some insight as to how many folks spend corporate resources mousing thru sites such as YouTube. Prolly not as much as a 500 Gbps spike but worth getting prepped for with a big event coming up on the other side of the planet.

January 20, 2009 at 9:48 am, Latest Antivirus Updates » Obama’s Inaugural DDoS Event Scheduled for 11:30 EST said:

[…] It is different than a DDoS “attack”. Some, such as Arbor Networks, have dubbed it “The Tiger Effect“. […]

December 12, 2009 at 8:16 am, Obama’s Inaugural DDoS Event Scheduled for 11:30 EST – Security Threat Research News said:

[…] It is different than a DDoS “attack”. Some, such as Arbor Networks, have dubbed it “The Tiger Effect“. […]

January 19, 2010 at 9:29 pm, Michael N. Dundas » Beijing 2008 Olympics said:

[…] was having lunch with a friend of mine today. He brought up “The Tiger Effect” that had happened during the U.S.Open. Specifically he asked what is going to happen to service providers in a few […]

Comments are closed.