Video Streaming: CDN Capacity and Playback Recovery

Video streaming: keep the next segment available

Netflix documents Open Connect as its video delivery network, including appliances embedded in participating ISP networks and interconnection arrangements. The delivery path varies with geography, ISP connectivity, and content availability. It is not accurate to promise that every viewer streams from a box a few miles away. Netflix Open Connect overview.

The rest of this article is a hypothetical streaming design. Capacity figures and segment lengths are assumptions, not Netflix measurements.

Size the bytes before the services

Assume 10,000 simultaneous viewers averaging 4 megabits per second. Video delivery requires approximately 40 gigabits per second. One hour transfers 18 terabytes in decimal units before protocol overhead. Serving playback through application servers would make bandwidth their dominant concern.

Now assume a 95% byte cache hit ratio. Origin still serves about 2 gigabits per second. A 95% request hit ratio is a different metric: missing a few large objects can transfer far more than 5% of bytes. Plan with both request and byte hit rates, and include the cold-cache case.

Separate the control path—sign-in, entitlement, catalog, playback authorization—from the media path. The control service gives an authorized client a manifest and bounded access credentials. The player obtains media segments through the delivery network. A recommendation failure should not automatically terminate a stream already playing.

Packaging creates choices for the player

Encode a source into several representations suited to supported devices and networks. For this example, use 1, 3, and 6 Mbps variants and four-second segments. A segment at 6 Mbps is approximately 3 MB; at 1 Mbps it is 0.5 MB. Audio and overhead are omitted from this calculation.

A playlist or manifest describes the available media. HLS supports both MPEG-2 transport stream and fragmented MP4 media; neither a four-second duration nor .ts files are universal requirements. Compatible segment boundaries and decoding dependencies matter when switching between representations. HLS specification, RFC 8216.

More variants improve device coverage and adaptation choices but increase encoding work, stored bytes, and cache fragmentation. Begin with a small ladder justified by source quality and target devices. Upscaling a low-resolution source does not restore detail.

What happens when throughput falls?

Suppose the player has 12 seconds buffered and is fetching a four-second, 6 Mbps segment. Throughput drops to 2 Mbps. Downloading the 24 megabits now takes about 12 seconds, using the entire buffer if nothing else intervenes. Remaining on the highest variant risks a stall.

A 1 Mbps segment would take about two seconds on that connection and add four seconds of playable media. The buffer can recover. A useful controller considers buffered duration, recent transfer estimates, and safety margins; it does not equate a “5G” label with reliable throughput. Switch upward cautiously to avoid oscillation.

Low startup delay and resilience pull in different directions. Waiting for a larger initial buffer protects playback but postpones the first frame. A live event also has a latency constraint: buffering a minute defeats a near-live product even if it eliminates many stalls.

Cache behavior during a release

Imagine 5,000 viewers start the same episode in one region within a minute. If the edge misses the first segment and forwards every request, origin sees thousands of identical fetches. Request collapsing can allow one origin fetch to satisfy waiting viewers. Pre-positioning expected popular content can help, but the estimate will be wrong for some titles and representations.

Use immutable versioned segment paths so a changed encoding cannot be confused with an older cached object. Manifests and authorization responses need separate cache rules. A signed query parameter included blindly in every cache key can turn the same segment into thousands of distinct cached entries; excluding security-sensitive fields without a separate authorization check is unsafe.

Design the outage path

If a delivery endpoint fails, the player can retry against an authorized alternate, with bounded retries and sufficient remaining buffer. Test alternate delivery capacity; a fallback that receives the entire failed region may overload immediately. Do not retry indefinitely at every layer.

Track startup time, rebuffered seconds per playback hour, playback failures, variant switches, origin egress, and regional byte hit ratio. Compare these by device and connection type so a healthy average cannot hide one broken player. A useful drill empties one edge cache and degrades throughput mid-session, then checks whether origin remains stable and playback recovers. This yields a measurable design decision; a claim of “zero buffering” does not.