Measuring characteristics of TCP connections at Internet scale

Cloudflare’s measurement paper shares aggregate insights into TCP connections established through its global CDN, describing a 1% passively collected sample of connections to Cloudflare between 7 and 15 October 2025, drawn from data describing about 70% of HTTP requests to their network. The dataset logs socket-level metadata via the Linux TCP_INFO structure, alongside SNI and the number of requests, while excluding individual HTTP transactions.

To represent a “useful” connection, the analysis requires a graceful close with a FIN packet and at least one successful HTTP request, a filter that leaves 11% of FIN-closed connections considered idle. Among the findings, the median Path MTU is 1500 bytes, with a 10th percentile of 1420 bytes and extreme cases as small as 552 bytes, while the initial congestion window median is about 464 KB (roughly 310 packets at a 1500‑byte MTU).

Connections show heavy-tailed patterns: the median connection duration is 4.7 seconds, and the average bytes sent by servers far exceed bytes received, driven by download-heavy flows and long-tail transfers.