Abstract
Zoom is a popular videoconferencing application for remote work and learning. In 2020, our university adopted Zoom for delivering online lectures during work-from-home restrictions. Starting in September 2021, however, our university offered both in-person and online classes, leading to increased Zoom usage on our campus network. In this paper, we study this Zoom network traffic in two different ways. First, we perform small-scale active measurements on individual Zoom test sessions to understand communication patterns and traffic structure. Second, we use large-scale passive measurement of campus-level Zoom traffic to understand usage patterns and performance problems. Our results identify 4x growth in Zoom traffic on our campus network since 2020, as well as network-related issues that affect Zoom session quality.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
- 2.
- 3.
Other experiments tested different features (e.g., camera, microphone, chat, screensharing, waiting room) to learn more about Zoom, similar to the approach in [8]. See Appendix B for two additional examples of such sessions.
- 4.
Though UDP is connectionless, we refer to these as UDP connections or channels.
- 5.
Documents sent via chat use a separate TCP connection to an XMPP server.
- 6.
We use threshold-based strategies, with average packet size as the primary feature, and average packet rate as a secondary feature. Directionality is also important.
- 7.
The client contacted a Zone Controller (ZC), and then switched the TCP control channel (but not the UDP channels) to a different Zoom MMR server.
- 8.
The dip at 12 noon is an artifact of our campus network monitor, which is restarted every 6 h to avoid possible crashes during high-volume scans [6]. This restart unfortunately loses information about connections in progress at 6:00 am, noon, 6:00 pm, and midnight. This artifact is most evident at 12 noon, when load is higher.
- 9.
We exclude the port profile, which is too cluttered to be useful.
- 10.
There is also a TCP control connection to this new server (not shown on graph).
- 11.
Curiously, two clients (IPs 9 and 11) choose the original Zoom server to handle failover as well, inducing extra connection overhead at an inopportune time.
References
Böttger, T., Ibrahim, G., Vallis, B.: How the internet reacted to Covid-19: a perspective from Facebook’s edge network. In: Proceedings of the ACM Internet Measurement Conference (IMC), Pittsburgh, PA, October 2020, pp. 34–41 (2020). https://doi.org/10.1145/3419394.3423621
Carman, A.: Why Zoom became so popular. The Verge. https://www.theverge.com/2020/4/3/21207053/zoom-video-conferencing-security-privacy-risk-popularity. (Accessed 19 Sept 2021)
Chang, H., Varvello, M., Hao, F., Mukherjee, S.: Can you see me now? A measurement study of Zoom, Webex, and Meet. In: Proceedings of ACM IMC, November 2021, pp. 216–228 (2021). https://doi.org/10.1145/3487552.3487847
Favale, T., Soro, F., Trevisan, M., Drago, I., Mellia, M.: Campus traffic and e-Learning during COVID-19 pandemic. Comput. Netw. 176, Article 107290, 1–9 (2020). https://doi.org/10.1016/j.comnet.2020.107290
Feldmann, A., Gasser, O., Lichtblau, F., Pujol, E., Poese, I., Dietzel, C., et al.: The lockdown effect: implications of the COVID-19 pandemic on internet traffic. In: Proceedings of ACM IMC, Pittsburgh, PA, October 2020, pp. 1–18 (202). https://doi.org/10.1145/3419394.3423658
Karamollahi, M., Williamson, C., Arlitt, M.: Zoomiversity: a case study of pandemic effects on post-secondary teaching and learning. In: Proceedings of Passive and Active Measurement (PAM) Conference, March 2022 (2022, to appear)
Liu, S., Schmitt, P., Bronzino, F., Feamster, N.: Characterizing service provider response to the COVID-19 pandemic in the United States. In: Hohlfeld, O., Lutu, A., Levin, D. (eds.) PAM 2021. LNCS, vol. 12671, pp. 20–38. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-72582-2_2
Lu, Y., Zhao, Y., Kuipers, F., Van Mieghem, P.: Measurement study of multi-party video conferencing. In: Crovella, M., Feeney, L.M., Rubenstein, D., Raghavan, S.V. (eds.) NETWORKING 2010. LNCS, vol. 6091, pp. 96–108. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-12963-6_8
Lutu, A., Perino, D., Bagnulo, M., Frias-Martinez, E., Khangosstar, J.: A characterization of the COVID-19 pandemic impact on a mobile network operator traffic. In: Proceedings of ACM IMC, Pittsburgh, PA, October 2020, pp. 19–33 (2020). https://doi.org/10.1145/3419394.3423655
MacMillan, K., Mangla, T., Saxon, J., Feamster, N.: Measuring the performance and network utilization of popular video conferencing applications. In: Proceedings of ACM IMC, November 2021, pp. 229–244 (2021). https://doi.org/10.1145/3487552.3487842
Mahr, A., Cichon, M., Mateo, S., Grajeda, C., Baggili, I.: Zooming into the Pandemic! A forensic analysis of the Zoom application. Forensic Sci. Inte.: Dig. Invest. 36, Article 301107, 7 (2021). https://doi.org/10.1016/j.fsidi.2021.301107
Marczak, B., Scott-Railton, J.: Move fast and roll your own crypto: a quick look at the confidentiality of Zoom meetings. Citizen Lab Research Report No. 126. University of Toronto, April 2020 (2020). (Accessed 23 Sept 2021)
Paxson, V.: Bro: a system for detecting network intruders in real-time. Comput. Netw. 31(23), 2435–2463 (1999). https://doi.org/10.1016/S1389-1286(99)00112-7
Sander, C., Kunze, I., Wehrle, K., Rüth, J.: Video conferencing and flow-rate fairness: a first look at Zoom and the impact of flow-queuing AQM. In: Proceedings of PAM Conference, Germany, March 2021, pp. 3–19 (2021). https://doi.org/10.1007/978-3-030-72582-2_1
Ukani, A., Mirian, A., Snoeren, A.: Locked-in during lock-down: undergraduate life on the internet in a pandemic. In: Proceedings of ACM IMC, November 2021, pp. 480–486 (2021). https://doi.org/10.1145/3487552.3487828
Wireshark.org, Wireshark frequently asked questions. https://www.wireshark.org/faq.html. (Accessed 22 Sept 2021)
Zoom, Zoom video conferencing plans and pricing. https://zoom.us/pricing. (Accessed 19 Sept 2021)
Acknowledgements
The authors thank the PAM 2022 reviewers and shepherd Matteo Varvello for their constructive suggestions that helped to improve our paper. Summer student Kiana Gardner helped with our active measurements, including the collection of Wireshark traces from Zoom test sessions. The authors are grateful to University of Calgary Information Technologies (UCIT) and the Conjoint Faculties Research Ethics Board (CFREB) for enabling the collection of our passive network traffic measurement data. Financial support for this work was provided by Canada’s Natural Sciences and Engineering Research Council (NSERC).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendices
Appendix A: Data Format and Analysis Tools
Figure 8 shows an example of the connection log data from the Zoom test session in Fig. 1. This format uses selected columns from the Zeek connection log [13]. Each line summarizes the network traffic on one connection (TCP, UDP, or ICMP). In this example, A.B.C.D is a laptop on the campus WiFi network, K.L.M.N is a laptop on a home network, and W.X.Y.Z is a Zoom MMR server. The number of users varied between 1 and 3, but the third user was off campus, and thus does not appear in the log. In this example, there were two UDP connection attempts before P2P mode was fully established. Also, an ICMP “port unreachable” message was sent when switching back to server mode.
Zeek connection log entries for Zoom test session (anonymized)
We have written C and Python programs to parse such log entries and produce graphical visualizations of Zoom sessions using gnuplot. Our C programs (called zoomparse.c, zoomplot.c, and zoomcount.c) produce a textual summary, intermediate data for graph plotting, and a statistical summary of Zoom sessions, respectively. We also have a Python program that parses full Zeek connection log entries, and produces a summary of Zoom sessions and Zoom meetings. The latter program relies on a database of Zoom server IP addresses and server types. Our software tools and graph plotting scripts are available from http://www.cpsc.ucalgary.ca/~carey/software.htm.
Appendix B: Additional Zoom Test Sessions
We collected Wireshark traces of several other Zoom sessions in order to identify typical and atypical behaviours. Figure 9 shows two unusual examples.
Figure 9(a) shows the packet traffic for a small meeting with three participants (all on their home networks), during which the presenter used the screen-sharing function to scroll through a large PDF document. In this example, the screen-sharing data volume (green) fluctuated dramatically, and actually exceeded the video traffic volume for most of the session.
Additional examples of Zoom test sessions in Wireshark
Figure 9(b) shows the video and audio packet traffic for an on-campus participant during a seven-person Zoom meeting. (We exclude the data and control traffic from the graph, since it is negligible.) There are extreme spikes in the traffic during this Zoom session, which had very poor QoE (the different colors in the graph show the audio and video disruptions). One of the spikes, near the 20-min mark, reflects Zoom’s bandwidth probing, which lasts for 10 s. The other spikes, however, are more extreme, and seem almost periodic. Each spike in the Wireshark trace lasts for only a second or two, and is preceded by a 2–3 s interval with no packets at all. Furthermore, the same pattern occurs in both the audio and video traffic (as well as non-Zoom traffic in the trace).
We do not believe that the traffic spikes in Fig. 9(b) are attributable to Zoom servers. Rather, this phenomenon could reflect congestion on the campus WiFi network (e.g., a large backlog at an AP), or could be a measurement artifact from running Wireshark on the same laptop as the Zoom session. We have observed this pattern in at least three different Wireshark traces, but have not yet been able to recreate it experimentally.
These examples help illustrate the variety of traffic patterns observed during our Zoom test sessions.
Rights and permissions
Copyright information
© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Choi, A., Karamollahi, M., Williamson, C., Arlitt, M. (2022). Zoom Session Quality: A Network-Level View. In: Hohlfeld, O., Moura, G., Pelsser, C. (eds) Passive and Active Measurement. PAM 2022. Lecture Notes in Computer Science, vol 13210. Springer, Cham. https://doi.org/10.1007/978-3-030-98785-5_25
Download citation
DOI: https://doi.org/10.1007/978-3-030-98785-5_25
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-98784-8
Online ISBN: 978-3-030-98785-5
eBook Packages: Computer ScienceComputer Science (R0)