CONCEPT Cited by 1 source
Diurnal traffic pattern¶
The diurnal traffic pattern is the day/night rhythm visible in any aggregate measurement of human-driven Internet traffic at country / regional / metropolitan scale: traffic rises in the morning local time, plateaus through working hours, often peaks in the evening (entertainment / social), and declines through the late-night hours. The shape is organic — produced by billions of independent human-scheduled access decisions (commute, work, lunch, dinner, bedtime) — and is one of the most reliable signatures of "real users" in network telemetry.
Why the diurnal shape matters as a signal¶
Because the curve emerges from uncoordinated human behaviour, it is costly to fake. Synthetic traffic, machine-to-machine traffic, and state-controlled / whitelist-only traffic all tend to lack the smooth bell-shape of a population's circadian rhythm. The presence of the diurnal pattern is therefore evidence of organic user activity — and its absence (flat 24-hour traffic, unusual nighttime sustainment, state-only business-hours-only patterns) is evidence to the contrary.
Three operational uses of the pattern recur across the wiki:
- Restoration validation after a shutdown. When traffic returns following a government-directed shutdown, one of the first things external observers look for is whether the diurnal curve re-establishes immediately. A re-established diurnal curve confirms the recovery is reaching real users; absent or flattened diurnal in the recovery period is consistent with continued state-controlled access only. Iran's May 26 2026 partial restoration is the canonical wiki instance — the day/night cycle returned within hours (decline ~21:00 UTC, return ~03:00 UTC at 06:30 local Tehran).
- Capacity planning + autoscaling. The peak-vs-trough ratio drives provisioning headroom; the pattern is what autoscaling systems are tuned to ride up and down through. See concepts/diurnal-autoscaling-risk for the failure shape when autoscaling can't keep up with the daily cycle.
- Anomaly detection. Per-country / per-AS / per-service baselines are typically expressed as a diurnal envelope; traffic that breaks out of the envelope (sudden drop at peak hours, sustained nighttime spike) flags as a traffic anomaly for further investigation.
Time-zone alignment is load-bearing¶
The diurnal pattern is anchored to local time, not UTC. A country's traffic curve typically peaks near 18:00–22:00 local; an external observer looking at a UTC dashboard has to mentally shift by the local UTC offset to interpret the shape. For small countries this is one offset; for the United States or Russia it's ~5 different local-time peaks staggered across the day in UTC.
Geographic envelope¶
The shape is more pronounced at small-country / single-region granularity (clean single-population circadian rhythm) and gets blurrier at multi-region or global aggregations (overlapping population bedtimes smooth the trough). The single sharpest diurnal curves on Cloudflare Radar are typically island nations and small countries with a single dominant urban population.
Seen in¶
- sources/2026-05-27-cloudflare-irans-internet-is-partially-restored-cloudflare-radar-data-shows — first canonical wiki instance of diurnal-pattern reappearance as shutdown-restoration-validation evidence. Iran's traffic declined ~21:00 UTC May 26 (matching evening Tehran time) and rose again at 03:00 UTC May 27 (matching 06:30 local Tehran morning), within hours of the partial restoration starting. Cited as one of three primary signals (alongside total bytes and 1.1.1.1 DNS queries) confirming the recovery reached real users rather than just permitted-traffic test endpoints.