Measuring characteristics of TCP connections at Internet scale

Cloudflare sampled 1% of web connections; geeks cheer, privacy purists rage

TLDR: Cloudflare shared aggregate insights from a 1% sample of global web connections to help simulate and improve networks. The crowd split: researchers praised the data’s usefulness, while privacy critics and protocol purists questioned bias, consent, and the omission of newer HTTP/3/QUIC traffic.

Cloudflare just dropped a juicy peek into how real internet connections behave—sampling 1% of traffic across its global content network—and the comments section went feral. Fans say this is the closest thing to a “weather report for the web,” pointing to the scope: 84 million requests per second, ~70% over old-school TCP (the behind-the-scenes handshake for loading pages). Skeptics fired back: Who asked Cloudflare to be hall monitor of the internet? Others questioned what’s missing—HTTP/3 runs on QUIC (a newer protocol), and this post focused on TCP only. Cue the bias wars: defenders argue Cloudflare’s diverse customer base makes the dataset richer than any single app’s logs, critics say it’s still one company’s viewpoint in one week (Oct 7–15, 2025), and simulation nerds debate whether this actually helps model the “real” internet. The meme brigade showed up with “Wireshark is a microscope, Cloudflare is the Hubble,” and a flood of “simulate the internet? good luck” GIFs. Researchers applauded the aggregate insights as rare and useful for safer testing than “deploy and pray,” while privacy hawks demanded raw data transparency or opt-outs. It’s nerd science meets watchdog snark—with popcorn-worthy energy in every thread. Read the post here: Cloudflare blog

Key Points

  • Cloudflare shares aggregate characteristics of TCP connections observed across its global CDN.
  • TCP constitutes about 70% of HTTP requests to Cloudflare, which averages ~84 million requests per second.
  • Telemetry covers HTTP 1.0, 1.1, and 2.0 traffic and labels connections as “Visitor to Cloudflare.”
  • Data is uniformly sampled at 1% of all TCP connections between October 7–15, 2025, at client-facing servers to reduce bias.
  • The measurements aim to support realistic network simulations, emphasizing data collection biases and limitations.

Hottest takes

"This ain't science, it's surveillance with charts" — privacy_potato
"Finally, real numbers to replace vibes and gut feels" — packetbender
"Cool flex, but you measured TCP while the web rides QUIC" — quic_or_die
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.